Uncaught Exception in Servlet

Opis

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Inne nazwy

Missing Catch Block

Skutki

• Confidentiality, Availability

  Read Application Data; DoS: Crash, Exit, or Restart

Zapobieganie

• Implementation

  Implement Exception blocks to handle all types of Exceptions.

Słabość nadrzędna

• CWE-248 Uncaught Exception

Może prowadzić do

• CWE-209 Generation of Error Message Containing Sensitive Information

Pokrewna

• CWE-390 Detection of Error Condition Without Action

Kiedy powstaje

• Implementation

Dotyczy

Java, Web Server

Uwagi

The "Missing Catch Block" concept is probably broader than just Servlets, but the broader concept is not sufficiently covered in CWE.