CWEweakness

CWE-600 Uncaught Exception in Servlet

Official page ↗
Alternate terms
Missing Catch Block
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Java
CWE version
5.0

Description

The Servlet does not catch all exceptions.

Common consequences

• Confidentiality, Availability: Read Application Data, DoS: Crash, Exit, or Restart — When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Potential mitigations

• [Implementation] Implement Exception blocks to handle all types of Exceptions.

Related

Can precede · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

Child of · CWE (1)

  • CWE-248 Uncaught Exception weakness

Peer of · CWE (1)

  • CWE-390 Detection of Error Condition Without Action weakness

Referenced by CVE · weakness (1)

  • CVE-2023-35123 Uncaught exception in OpenBMC Firmware for some Intel(R) Server Platforms before versions egs-1.14-0, bhs-0.27 may allow an authenticated… vulnerability