...
Exception Name | Description of information leak or threat |
|---|---|
| Underlying file system structure, user name enumeration |
| Database structure, user name enumeration |
| Enumeration of open ports when untrusted client can choose server port |
| May provide information about thread-unsafe code |
| Insufficient server resources (may aid DoS) |
| Resource enumeration |
| Underlying file system structure |
| Owner enumeration |
| Denial of service (DoS) |
| Denial of service (DoS) |
Printing the stack trace can also result in unintentionally leaking information about the structure and state of the process to an attacker. If a Java program is run within a console, and it terminates due to an uncaught exception, the exception's message and stack trace are displayed on the console; the stack trace may itself indicate sensitive information about the program's internal structure. Therefore command-line programs must never abort due to an uncaught exception.
Noncompliant Code Example (Leaks from Exception Message and Type)
...