CWE Database
/

CWE-600

Back to CWE list

CWE-600

Uncaught Exception in Servlet

Variant
Draft

Description

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

Parent Weaknesses (ChildOf)

Common Consequences

Scope

Confidentiality
Availability

Impact

Read Application Data, DoS: Crash, Exit, or Restart

Potential Mitigations

Implementation

Implement Exception blocks to handle all types of Exceptions.

Applicable Platforms

Java

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now