1044
Nature Type ID Name Page
ChildOf 691 Insufficient Control Flow Management 1517
CanPrecede 433 Unparsed Raw Web Content Delivery 1046
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 429 Handler Errors 2326
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Phase: Implementation
Handle all possible situations (e.g. error condition).
Phase: Implementation
If an operation can throw an Exception, implement a handler for that specific exception.
Demonstrative Examples
Example 1:
If a Servlet does not catch all exceptions, it may reveal debugging information that will help an
adversary form a plan of attack. In the following method a DNS lookup failure will cause the Servlet
to throw an exception.
Example Language: Java (Bad)
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {
String ip = req.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
...
out.println("hello " + addr.getHostName());
}
When a Servlet throws an exception, the default error response the Servlet container sends back to
the user typically includes debugging information. This information is of great value to an attacker.
Observed Examples
Reference Description
CVE-2022-25302 SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a
cast fails, allowing for a crash
https://www.cve.org/CVERecord?id=CVE-2022-25302
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
CWE Version 4.14
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations