CWE-600: Failure to Catch All Exceptions in Servlet
Failure to Catch All Exceptions in Servlet
Weakness ID: 600 (Weakness Base)
Status: Draft
Description
Description Summary
A Servlet fails to catch all exceptions, which may reveal
sensitive debugging information.
Extended Description
When a Servlet throws an exception, the default error response the Servlet
container sends back to the user typically includes debugging information.
This information is of great value to an attacker. For example, a stack
trace might show the attacker a malformed SQL query string, the type of
database being used, and the version of the application container. This
information enables the attacker to target known vulnerabilities in these
components.
Alternate Terms
Missing Catch Block
Time of Introduction
Implementation
Demonstrative Examples
Example 1
In the following method a DNS lookup failure will cause the Servlet
to throw an exception.
Description
