Information Loss or Omission

Opis

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Skutki

• Non-Repudiation

  Hide Activities

Przykłady podatności

• CVE-2004-2227 Web browser's filename selection dialog only shows the beginning portion of long filenames, which can trick users into launching executables with dangerous extensions.
• CVE-2003-0412 application server does not log complete URI of a long request (truncation).
• CVE-1999-1029 Login attempts are not recorded if the user disconnects before the maximum number of tries.
• CVE-2002-0725 Attacker performs malicious actions on a hard link to a file, obscuring the real target file.
• CVE-1999-1055 Product does not warn user when document contains certain dangerous functions or macros.

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Słabości podrzędne

• CWE-222 Truncation of Security-relevant Information
• CWE-223 Omission of Security-relevant Information
• CWE-224 Obscured Security-relevant Information by Alternate Name
• CWE-356 Product UI does not Warn User of Unsafe Actions
• CWE-396 Declaration of Catch for Generic Exception
• CWE-397 Declaration of Throws for Generic Exception
• CWE-451 User Interface (UI) Misrepresentation of Critical Information

Kiedy powstaje

• Architecture and Design
• Implementation
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific