CWE-600
Uncaught Exception in Servlet
2006-12-15
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Uncaught Exception in Servlet
The Servlet does not catch all exceptions.
Thông tin chung
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Tên: Java (Undetermined)Công nghệ
Tên: Web Server (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Confidentiality Availability | Read Application Data, DoS: Crash, Exit, or Restart Ghi chú: When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components. |
Các biện pháp giảm thiểu tiềm năng
Phases : ImplementationImplement Exception blocks to handle all types of Exceptions.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Ghi chú
The "Missing Catch Block" concept is probably broader than just Servlets, but the broader concept is not sufficiently covered in CWE.Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| CWE Community | Draft 5 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes | |
| CWE Content Team | MITRE | updated Alternate_Terms, Description, Maintenance_Notes, Name, Other_Notes, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships, Type | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
