Class weakness
Incomplete
CWE-221: Information Loss or Omission
The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Class
Abstraction
MITRE classification
Overview
CWE-221 (Information Loss or Omission) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Common consequences
What can happen when CWE-221 is exploited.
Hide Activities
Affects: Non-Repudiation
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Architecture and Design
Implementation
Operation
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
This code logs suspicious multiple login attempts.
Vulnerable example
php
function login($userName,$password){