CWE-600: Uncaught Exception in Servlet
Also known as: Missing Catch Block
The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
Last updated
Overview
When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.
Real-world CVEs
1 recorded CVEs are caused by CWE-600 (Uncaught Exception in Servlet). The highest-severity and most recent are shown first.
Common consequences
What can happen when CWE-600 is exploited.
Read Application Data, DoS: Crash, Exit, or Restart
Affects: Confidentiality, Availability
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.