Truncation of Security-relevant Information

Opis

The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.

Skutki

• Non-Repudiation

  Hide Activities

  The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

Przykłady podatności

• CVE-2005-0585 Web browser truncates long sub-domains or paths, facilitating phishing.
• CVE-2004-2032 Bypass URL filter via a long URL with a large number of trailing hex-encoded space characters.
• CVE-2003-0412 application server does not log complete URI of a long request (truncation).

Słabość nadrzędna

• CWE-221 Information Loss or Omission

Kiedy powstaje

• Implementation
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific