CWE-600

Uncaught Exception in Servlet
AI Translation Available

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

Status
draft
Abstraction
variant
Java Web Server

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Common Consequences

confidentiality availability
Impacts
read application data dos: crash, exit, or restart

Potential Mitigations

Phases:
implementation
Descriptions:
• Implement Exception blocks to handle all types of Exceptions.