The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

What CVEs are caused by CWE-703?

139 recorded CVEs are attributed to CWE-703, including CVE-2022-22265, CVE-2021-25370, CVE-2021-25372. 3 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How is CWE-703 detected?

Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful:

What are the consequences of CWE-703?

Exploiting CWE-703 can lead to: Read Application Data, DoS: Crash, Exit, or Restart, Unexpected State.

Is CWE-703 actively exploited?

Yes. 3 CWE-703 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 139 recorded CVEs.

CWE-703: Improper Check or Handling of Exceptional Conditions

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

Consider the following code segment:

Vulnerable example

char buf[10], cp_buf[10];

The programmer expects that when fgets() returns, buf will contain a null-terminated string of length 9 or less. But if an I/O error occurs, fgets() will not null-terminate buf. Furthermore, if the end of the file is reached before any characters are read, fgets() returns without writing anything to buf. In both of these situations, fgets() signals that something unusual has happened by returning NULL, but in this code, the warning will not be noticed. The lack of a null terminator in buf can result in a buffer overflow in the subsequent call to strcpy().

The following method throws three types of exceptions.

Safe example

java

public void doExchange() throws IOException, InvocationTargetException, SQLException {

Vulnerable example

java

public void doExchange() throws Exception {

CWE-703: Improper Check or Handling of Exceptional Conditions

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Dynamic Analysis with Manual Results Interpretation

Manual Static Analysis - Source Code

Automated Static Analysis - Source Code

Architecture or Design Review

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-703

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to detect it

Dynamic Analysis with Manual Results Interpretation

Manual Static Analysis - Source Code

Automated Static Analysis - Source Code

Architecture or Design Review

Code examples

Illustrative examples

Related weaknesses

Child

Terminology & mappings

Mapped taxonomies

Frequently asked questions

References

Stay ahead of CWE-703