CWE

CWE-223 – Omission of Security-relevant Information

rocco
Read Time:34 Second

Description

The application does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-221

 

Consequences

Non-Repudiation: Hide Activities

The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

 

Potential Mitigations

CVE References

  • CVE-1999-1029
    • Login attempts not recorded if user disconnects before maximum number of tries.
  • CVE-2002-1839
    • Sender’s IP address not recorded in outgoing e-mail.
  • CVE-2000-0542
    • Failed authentication attempt not recorded if later attempt succeeds.
In, ,

More Stories