CWEweakness

CWE-223 Omission of Security-relevant Information

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Common consequences

• Non-Repudiation: Hide Activities — The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

Observed examples

• CVE-1999-1029: Login attempts are not recorded if the user disconnects before the maximum number of tries. • CVE-2002-1839: Sender's IP address not recorded in outgoing e-mail. • CVE-2000-0542: Failed authentication attempts are not recorded if later attempt succeeds.

Related

Observed example · CVE (3)

  • CVE-2002-1839 Trend Micro InterScan VirusWall for Windows NT 3.52 does not record the sender's IP address in the headers for a mail message when it is… vulnerability
  • CVE-2000-0542 Tigris remote access server before 11.5.4.22 does not properly record Radius accounting information when a user fails the initial login… vulnerability
  • CVE-1999-1029 SSH server (sshd2) before 2.0.12 does not properly record login attempts if the connection is closed before the maximum number of tries,… vulnerability

Child of · CWE (1)

  • CWE-221 Information Loss or Omission weakness

Referenced by CVE · weakness (12)

  • CVE-2026-91859 Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. vulnerability
  • CVE-2026-90955 Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging. vulnerability
  • CVE-2026-49426 When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to… vulnerability
  • CVE-2025-35987 Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center Attestation Primitives within Ring 0:… vulnerability
  • CVE-2026-31890 Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using… vulnerability
  • CVE-2025-52926 In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface. vulnerability
  • CVE-2024-52813 matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. vulnerability
  • CVE-2023-29156 DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. vulnerability
  • CVE-2023-31191 DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. vulnerability
  • CVE-2023-28360 An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file… vulnerability
  • CVE-2022-44646 In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings vulnerability
  • CVE-2022-22563 Dell EMC Powerscale OneFS 8.2.x - 9.2.x omit security-relevant information in /etc/master.passwd. vulnerability

Referenced by CWE · child of (2)

  • CWE-1429 Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface weakness
  • CWE-778 Insufficient Logging weakness

Referenced by CWE · has member (1)

Referenced by OWASP · mapped cwe (2)

  • A09:2025 Security Logging & Alerting Failures Top 10 2025
  • A09:2021 Security Logging and Monitoring Failures Top 10 2021