名称: Information Loss or Omission
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
基本信息
引入方式
Architecture and DesignImplementation
Operation
适用平台
编程语言
类： Not Language-Specific (Undetermined)技术
类： Not Technology-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Non-Repudiation | Hide Activities |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2004-2227 | Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions. |
CVE-2003-0412 | application server does not log complete URI of a long request (truncation). |
CVE-1999-1029 | Login attempts are not recorded if the user disconnects before the maximum number of tries. |
CVE-2002-0725 | Chain: File system allows local attackers to hide file usage activities via a hard link (CWE-65) to the target file, which causes the link to be recorded in the audit trail instead of the target file (CWE-221). |
CVE-1999-1055 | Product does not warn user when document contains certain dangerous functions or macros. |
漏洞映射说明
依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate备注 : Examine children of this entry to see if there is a better fit
相关攻击模式
| CAPEC ID | 攻击模式名称 |
|---|---|
| CAPEC-81 | Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application. |
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Description, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships |
