名稱: Uncaught Exception in Servlet
The Servlet does not catch all exceptions.
一般資訊
引入方式
Implementation適用平台
程式語言
名稱： Java (Undetermined)技術
名稱： Web Server (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Confidentiality Availability | Read Application Data, DoS: Crash, Exit, or Restart 注意：When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components. |
潛在緩解措施
Phases : ImplementationImplement Exception blocks to handle all types of Exceptions.
漏洞對應備注
理由說明 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
The "Missing Catch Block" concept is probably broader than just Servlets, but the broader concept is not sufficiently covered in CWE.提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Community | Draft 5 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Other_Notes | |
| CWE Content Team | MITRE | updated Alternate_Terms, Description, Maintenance_Notes, Name, Other_Notes, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships, Type | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
