CWE

Common Weakness Enumeration

Celebrating 20 years of community-developed cybersecurity weakness knowledge!
New to CWE? click here!
CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE List > CWE-391: DEPRECATED: Unchecked Error Condition (5.0)  
ID

CWE-391: DEPRECATED: Unchecked Error Condition

Weakness ID: 391
Vulnerability Mapping: PROHIBITED This CWE ID must not be used to map to real-world vulnerabilities
Abstraction: Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
View customized information:
Shows the description and diagram, platforms, mitigations, consequences, relationships, memberships, and content history. For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
×

Edit Custom Filter


+ Description
This entry has been deprecated because it used ambiguous terminology and incorporated and confused multiple weaknesses. See Mapping Notes for other recommendations, and see Maintenance Notes for more detailed explanations.
+ Dimensions
Section HelpThe Dimensions table provides information about the different dimensions associated with this weakness. The Type identifies the dimension type, while the Value provides the specific value for that dimension.
TypeValue
Behavior-PropertyUnchecked
Behavior-TypeError Condition
+ Vulnerability Mapping Notes
Usage PROHIBITED
(this CWE ID must not be used to map to real-world vulnerabilities)
Reasons Deprecated, Frequent Misuse, Frequent Misinterpretation

Rationale

This CWE has been deprecated.

Comments

This entry has multiple widespread interpretations by CWE analysts, partially due to its ambiguous name. It combines information from three different taxonomies, but each taxonomy is talking about a slightly different issue. See Maintenance Notes.

Suggestions

CWE-ID Comment
CWE-252 Unchecked Return Value
CWE-1069 Empty Exception Block
CWE-248 Uncaught Exception
CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-755 Improper Check for Unusual or Exceptional Conditions
+ Notes

Maintenance

Version: 5.0; Release Date: 2026-10-28

This entry has been deprecated. It has multiple widespread interpretations by CWE analysts. It combined information from three different taxonomies, but each taxonomy was covering a slightly different weakness. CWE analysts might map to this entry based on any of these issues.

  • 7PK has "Empty Catch Block" which has an association with empty exception block (CWE-1069); in this case, the exception has performed the check, but does not handle it appropriately.
  • In PLOVER, there is "Unchecked Return Value" (CWE-252), but unlike "Empty Catch Block" there isn't even a check of the issue - and "Unchecked Error Condition" implies lack of a check.
  • For CLASP, "Uncaught Exception" (CWE-248) is associated with incorrect error propagation - uncovered in CWE 3.2 and earlier, at least. There are other issues related to error handling and checks.
+ Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Unchecked Return Value
7 Pernicious Kingdoms Empty Catch Block
CLASP Uncaught exception
OWASP Top Ten 2004 A7 CWE More Specific Improper Error Handling
CERT C Secure Coding ERR00-C Adopt and implement a consistent and comprehensive error-handling policy
CERT C Secure Coding ERR33-C CWE More Abstract Detect and handle standard library errors
CERT C Secure Coding ERR34-C CWE More Abstract Detect errors when converting a string to a number
CERT C Secure Coding FLP32-C Imprecise Prevent or detect domain and range errors in math functions
CERT C Secure Coding POS54-C CWE More Abstract Detect and handle POSIX library errors
SEI CERT Perl Coding Standard EXP31-PL Imprecise Do not suppress or ignore exceptions
Software Fault Patterns SFP4 Unchecked Status Condition
+ References
[REF-18] Secure Software, Inc.. "The CLASP Application Security Process". 2005.
<https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf>. (URL validated: 2024-11-17)
+ Content History
+ Submissions
Submission Date Submitter Organization
2006-07-19
(CWE Draft 3, 2006-07-19) 		PLOVER
+ Modifications
Modification Date Modifier Organization
2026-10-28
(CWE 5.0, 2026-10-28) 		CWE Content Team MITRE
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Dimensions, Likelihood_of_Exploit, Maintenance_Notes, Mapping_Notes, Modes_of_Introduction, Name, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction, Type, Weakness_Ordinalities
2026-10-27
(CWE 5.0, 2026-10-28) 		CWE Content Team MITRE
Deprecated this entry.
2025-12-11
(CWE 4.19, 2025-12-11) 		CWE Content Team MITRE
updated Relationships, Weakness_Ordinalities
2024-02-29
(CWE 4.14, 2024-02-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-06-29
(CWE 4.12, 2023-06-29) 		CWE Content Team MITRE
updated Mapping_Notes
2023-04-27
(CWE 4.11, 2023-04-27) 		CWE Content Team MITRE
updated Detection_Factors, Relationships, Time_of_Introduction
2021-07-20
(CWE 4.5, 2021-07-20) 		CWE Content Team MITRE
updated Relationships
2021-03-15
(CWE 4.4, 2021-03-15) 		CWE Content Team MITRE
updated Description, Relationships
2020-12-10
(CWE 4.3, 2020-12-10) 		CWE Content Team MITRE
updated Relationships
2020-08-20
(CWE 4.2, 2020-08-20) 		CWE Content Team MITRE
updated Relationships
2020-02-24
(CWE 4.0, 2020-02-24) 		CWE Content Team MITRE
updated References
2019-06-20
(CWE 3.3, 2019-06-20) 		CWE Content Team MITRE
updated Description, Maintenance_Notes
2019-01-03
(CWE 3.2, 2019-01-03) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2017-11-08
(CWE 3.0, 2017-11-08) 		CWE Content Team MITRE
updated Applicable_Platforms, Modes_of_Introduction, Relationships, Taxonomy_Mappings, White_Box_Definitions
2014-07-30
(CWE 2.8, 2014-07-31) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2014-06-23
(CWE 2.7, 2014-06-23) 		CWE Content Team MITRE
updated Other_Notes
2012-10-30
(CWE 2.3, 2012-10-30) 		CWE Content Team MITRE
updated Potential_Mitigations
2012-05-11
(CWE 2.2, 2012-05-15) 		CWE Content Team MITRE
updated Relationships
2011-09-13
(CWE 2.1, 2011-09-13) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2011-06-27
(CWE 2.0, 2011-06-27) 		CWE Content Team MITRE
updated Common_Consequences
2011-06-01
(CWE 1.13, 2011-06-01) 		CWE Content Team MITRE
updated Common_Consequences
2009-07-27
(CWE 1.5, 2009-07-27) 		CWE Content Team MITRE
updated White_Box_Definitions
2009-07-17
(CWE 1.5, 2009-07-27) 		KDM Analytics
Improved the White_Box_Definition
2009-05-27
(CWE 1.4, 2009-05-27) 		CWE Content Team MITRE
updated Demonstrative_Examples
2008-11-24
(CWE 1.1, 2008-11-25) 		CWE Content Team MITRE
updated Relationships, Taxonomy_Mappings
2008-09-08
(CWE 1.0, 2008-09-09) 		CWE Content Team MITRE
updated Maintenance_Notes, Relationships, Other_Notes, Taxonomy_Mappings
2008-08-15
(CWE 1.0, 2008-09-09) 		Veracode
Suggested OWASP Top Ten 2004 mapping
2008-08-01
(CWE 1.0, 2008-09-09) 		KDM Analytics
added/updated white box definitions
2008-07-01
(CWE 1.0, 2008-09-09) 		Eric Dalci Cigital
updated Time_of_Introduction
+ Previous Entry Names
Change Date Previous Entry Name
2026-10-28 Unchecked Error Condition
Page Last Updated: Oct 28, 2026
 

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.