CWE-230: Improper Handling of Missing Values Improper Handling of Missing Values
Weakness ID: 230 (Weakness Base) Status: Draft
Description
Description Summary
The software does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing , i.e. it is empty, blank, or null.
Time of Introduction
Common Consequences
Scope Effect Integrity
Technical Impact: Unexpected state
Observed Examples
Reference Description CVE-2002-0422 Blank Host header triggers resultant
infoleak. CVE-2000-1006 Blank "charset" attribute in MIME header triggers
crash. CVE-2004-1504 Blank parameter causes external error
infoleak. CVE-2005-2053 Blank parameter causes external error
infoleak.
Relationships
Research Gaps
Some "crash by port scan" bugs are probably due to this, but lack of
diagnosis makes it difficult to be certain.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Missing Value Error CERT Java Secure Coding ERR08-J Do not catch NullPointerException or any of its
ancestors
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Other_Notes,
Taxonomy_Mappings 2009-03-10 CWE Content Team MITRE Internal updated Description, Name 2009-10-29 CWE Content Team MITRE Internal updated Other_Notes, Research_Gaps 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences, Relationships,
Taxonomy_Mappings 2011-06-27 CWE Content Team MITRE Internal updated Common_Consequences 2012-05-11 CWE Content Team MITRE Internal updated Relationships Previous Entry Names Change Date Previous Entry
Name 2008-04-11 Missing Value
Error 2009-03-10 Failure to Handle Missing
Value
Description
