CWE-600—Uncaught Exception in Servlet

名称

Uncaught Exception in Servlet

描述

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

常见后果

范围：

Confidentiality, Availability

影响：

Read Application Data, DoS: Crash, Exit, or Restart

相关 CWE

• CWE-209Generation of Error Message Containing Sensitive InformationHigh
• CWE-248Uncaught Exception
• CWE-390Detection of Error Condition Without ActionMedium