5
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 756 Missing Custom Error Page 1579
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
A stack trace might show the attacker a malformed SQL
query string, the type of database being used, and the
version of the application container. This information
enables the attacker to target known vulnerabilities in
these components.
Potential Mitigations
Phase: Implementation
Handle exceptions appropriately in source code.
Phase: Implementation
Phase: System Configuration
Always define appropriate error pages. The application configuration should specify a default
error page in order to guarantee that the application will never leak error messages to an
attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a
good security practice, and a good configuration will also define a last-chance error handler that
catches any exception that could possibly be thrown by the application.
Phase: Implementation
Do not attempt to process an error or attempt to mask it.
Phase: Implementation
Verify return values are correct and do not supply sensitive information about the system.
Demonstrative Examples
Example 1:
In the snippet below, an unchecked runtime exception thrown from within the try block may cause
the container to display its default error page (which may contain a full stack trace, among other
things).
Example Language: Java (Bad)
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
...
} catch (ApplicationSpecificException ase) {
logger.error("Caught: " + ase.toString());
}
}
MemberOf Relationships
CWE Version 4.14
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote