CWE-223: Omission of Security-relevant Information
Omission of Security-relevant Information
Weakness ID: 223 (Weakness Base)
Status: Draft
Description
Description Summary
The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Non-Repudiation
Technical Impact: Hide activities
Demonstrative Examples
Example 1
This code logs suspicious multiple login attempts.
(Bad Code)
Example
Language: PHP
function login($userName,$password){
if(authenticate($userName,$password)){
return True;
}
else{
incrementLoginAttempts($userName);
if(recentLoginAttempts($userName) > 5){
writeLog("Failed login attempt by User: " . $userName
. " at " + date('r') );
}
}
}
This code only logs failed login attempts when a certain limit is
reached. If an attacker knows this limit, he or she can stop his attack
from being discovered by avoiding the limit.
Description
