The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
View on MITREIt is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
No detection method information available for this CWE.
Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect).
Temporary file not deleted after use, leaking database usernames and passwords.
View DetailsInteraction error creates a temporary file that can not be deleted due to strong permissions.
View DetailsAlternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
View DetailsAlternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
View DetailsAlternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
View DetailsAlternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
View DetailsAlternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
View DetailsUsers not logged out when application is restarted after security-relevant changes were made.
View DetailsCWE-459: Incomplete Cleanup is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
If exploited, CWE-459 (Incomplete Cleanup) it can compromise Other, Confidentiality and Integrity, leading to outcomes such as Other, Read Application Data, Modify Application Data and DoS: Resource Consumption (Other).
Recommended mitigations for CWE-459 include: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
CWE-459 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-459, including CVE-2000-0552, CVE-2005-2293, CVE-2002-0788, CVE-2002-2066 and CVE-2002-2067. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-459 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.