4
for the session ID length default setting and configuration options to ensure that the session ID
length is set to 128 bits.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 2 7PK - Environment 700 2308
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 965 SFP Secondary Cluster: Insecure Session Management 888 2403
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms J2EE Misconfiguration: Insufficient
Session-ID Length
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
59 Session Credential Falsification through Prediction
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-482]Zvi Gutterman. "Hold Your Sessions: An Attack on Java Session-id Generation". 2005
February 3. < https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/gm05.pdf
>.2023-04-07.
CWE-7: J2EE Misconfiguration: Missing Custom Error Page
Weakness ID : 7
Structure : Simple
Abstraction : Variant
Description
The default error page of a web application should not display sensitive information about the
product.
Extended Description
A Web application must define a default error page for 4xx errors (e.g. 404), 5xx (e.g. 500) errors
and catch java.lang.Throwable exceptions to prevent attackers from mining information from the
application container's built-in error response.
When an attacker explores a web site looking for vulnerabilities, the amount of information that the
site provides is crucial to the eventual success or failure of any attempted attacks.
Relationships
CWE Version 4.14
CWE-7: J2EE Misconfiguration: Missing Custom Error Page
CWE-7: J2EE Misconfiguration: Missing Custom Error Page