CWEweakness

CWE-221 Information Loss or Omission

Official page ↗
Abstraction
Class
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Common consequences

• Non-Repudiation: Hide Activities

Observed examples

• CVE-2004-2227: Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions. • CVE-2003-0412: application server does not log complete URI of a long request (truncation). • CVE-1999-1029: Login attempts are not recorded if the user disconnects before the maximum number of tries. • CVE-2002-0725: Chain: File system allows local attackers to hide file usage activities via a hard link (CWE-65) to the target file, which causes the link to be recorded in the audit trail instead of the target file (CWE-221). • CVE-1999-1055: Product does not warn user when document contains certain dangerous functions or macros.

Related

Attack pattern · CAPEC (1)

  • CAPEC-81 Web Server Logs Tampering attack pattern

Observed example · CVE (5)

  • CVE-2004-2227 Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick… vulnerability
  • CVE-2003-0412 Sun ONE Application Server 7.0 for Windows 2000/XP does not log the complete URI of a long HTTP request, which could allow remote attackers… vulnerability
  • CVE-2002-0725 NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target… vulnerability
  • CVE-1999-1055 Microsoft Excel 97 does not warn the user before executing worksheet functions, which could allow attackers to execute arbitrary commands… vulnerability
  • CVE-1999-1029 SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries,… vulnerability

Child of · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-81 Web Server Logs Tampering attack pattern

Referenced by CVE · weakness (3)

  • CVE-2026-106287 Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via crafted network… vulnerability
  • CVE-2026-87535 Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system… vulnerability
  • CVE-2025-62306 HCL IntelliOps Event Management (IEM) is affected by information omission. vulnerability

Referenced by CWE · child of (6)

  • CWE-222 Truncation of Security-relevant Information weakness
  • CWE-223 Omission of Security-relevant Information weakness
  • CWE-224 Obscured Security-relevant Information by Alternate Name weakness
  • CWE-396 Declaration of Catch for Generic Exception weakness
  • CWE-397 Declaration of Throws for Generic Exception weakness
  • CWE-451 User Interface (UI) Misrepresentation of Critical Information weakness

Referenced by OWASP · mapped cwe (1)

  • A09:2025 Security Logging & Alerting Failures Top 10 2025