1506
Nature Type ID Name Page
ParentOf 392 Missing Report of Error Condition 951
ParentOf 393 Return of Wrong Status Code 953
ParentOf 440 Expected Behavior Violation 1062
ParentOf 446 UI Discrepancy for Security Feature 1073
ParentOf 451 User Interface (UI) Misrepresentation of Critical Information 1079
ParentOf 912 Hidden Functionality 1803
ParentOf 1245 Improper Finite State Machines (FSMs) in Hardware Logic 2041
Weakness Ordinalities
Indirect :
Primary :
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Potential Mitigations
Phase: Implementation
Ensure that your code strictly conforms to specifications.
Demonstrative Examples
Example 1:
In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even
if an error occurs.
Example Language: Java (Bad)
try {
// Something that may throw an exception.
...
} catch (Throwable t) {
logger.error("Caught: " + t.toString());
return;
}
Example 2:
In the following example, an HTTP 404 status code is returned in the event of an IOException
encountered in a Java servlet. A 404 code is typically meant to indicate a non-existent resource
and would be somewhat misleading in this case.
Example Language: Java (Bad)
try {
// something that might throw IOException
...
} catch (IOException ioe) {
response.sendError(SC_NOT_FOUND);
}
Observed Examples
Reference Description
CVE-2002-1446 Error checking routine in PKCS#11 library returns "OK" status even when
invalid signature is detected, allowing spoofed messages.
https://www.cve.org/CVERecord?id=CVE-2002-1446
CWE Version 4.14
CWE-685: Function Call With Incorrect Number of Arguments
CWE-685: Function Call With Incorrect Number of Arguments