The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Primary

Resultant

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Implementation

Operation

Non-Repudiation
Hide Activities
The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

This code logs suspicious multiple login attempts.

function login($userName,$password){
if(authenticate($userName,$password)){return True;}else{incrementLoginAttempts($userName);if(recentLoginAttempts($userName) > 5){writeLog("Failed login attempt by User: " . $userName . " at " + date('r') );}}
}

This code only logs failed login attempts when a certain limit is reached. If an attacker knows this limit, they can stop their attack from being discovered by avoiding the limit.

This code prints the contents of a file if a user has permission.

function readFile($filename){
$user = getCurrentUser();$realFile = $filename;

//resolve file if its a symbolic link
if(is_link($filename)){$realFile = readlink($filename);}
if(fileowner($realFile) == $user){echo file_get_contents($realFile);return;}else{echo 'Access denied';writeLog($user . ' attempted to access the file '. $filename . ' on '. date('r'));}
}

While the code logs a bad access attempt, it logs the user supplied name for the file, not the canonicalized file name. An attacker can obscure their target by giving the script the name of a link to the file they are attempting to access. Also note this code contains a race condition between the is_link() and readlink() functions (CWE-363).

CVE-1999-1029
Login attempts are not recorded if the user disconnects before the maximum number of tries.
https://www.cve.org/CVERecord?id=CVE-1999-1029

CVE-2002-1839
Sender's IP address not recorded in outgoing e-mail.
https://www.cve.org/CVERecord?id=CVE-2002-1839

CVE-2000-0542
Failed authentication attempts are not recorded if later attempt succeeds.
https://www.cve.org/CVERecord?id=CVE-2000-0542

Omission of Security-relevant Information

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2009-07-27
updated Relationships

CWE Content Team
MITRE
2011-03-29
updated Demonstrative_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, References, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Demonstrative_Examples, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Demonstrative_Examples, Observed_Examples

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities