A handler is not available or implemented.
When an exception is thrown and not caught, the process has given up an opportunity to decide if a given failure or event is worth a change in execution.
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2022-25302
SDK for OPC Unified Architecture (OPC UA) is missing a handler for when a cast fails, allowing for a crash
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: If a Servlet does not catch all exceptions, it may reveal debugging information that will help an adversary form a plan of attack. In the following method a DNS lookup failure will cause the Servlet to throw an exception.
Body: When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker.
protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException { String ip = req.getRemoteAddr(); InetAddress addr = InetAddress.getByName(ip); ... out.println("hello " + addr.getHostName()); }