951
Maintenance
This entry is slated for deprecation; it has multiple widespread interpretations by CWE analysts.
It currently combines information from three different taxonomies, but each taxonomy is talking
about a slightly different issue. CWE analysts might map to this entry based on any of these
issues. 7PK has "Empty Catch Block" which has an association with empty exception block
(CWE-1069); in this case, the exception has performed the check, but does not handle. In
PLOVER there is "Unchecked Return Value" which is CWE-252, but unlike "Empty Catch Block"
there isn't even a check of the issue - and "Unchecked Error Condition" implies lack of a check.
For CLASP, "Uncaught Exception" (CWE-248) is associated with incorrect error propagation -
uncovered in CWE 3.2 and earlier, at least. There are other issues related to error handling and
checks.
Other
When a programmer ignores an exception, they implicitly state that they are operating under one
of two assumptions: This method call can never fail. It doesn't matter if this call fails.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unchecked Return Value
7 Pernicious Kingdoms Empty Catch Block
CLASP Uncaught exception
OWASP Top Ten 2004 A7 CWE More Specific Improper Error Handling
CERT C Secure Coding ERR00-
C
Adopt and implement a consistent and
comprehensive error-handling policy
CERT C Secure Coding ERR33-
C
CWE More
Abstract
Detect and handle standard library
errors
CERT C Secure Coding ERR34-
C
CWE More
Abstract
Detect errors when converting a string
to a number
CERT C Secure Coding FLP32-C Imprecise Prevent or detect domain and range
errors in math functions
CERT C Secure Coding POS54-
C
CWE More
Abstract
Detect and handle POSIX library errors
SEI CERT Perl Coding
Standard
EXP31-
PL
Imprecise Do not suppress or ignore exceptions
Software Fault Patterns SFP4 Unchecked Status Condition
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-392: Missing Report of Error Condition
Weakness ID : 392
Structure : Simple
Abstraction : Base
Description
The product encounters an error but does not provide a status code or return value to indicate that
an error has occurred.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-392: Missing Report of Error Condition
CWE-392: Missing Report of Error Condition