CWE-584: Return Inside Finally Block

BaseDraft

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
Platforms

Frequently Asked Questions

What is CWE-584: Return Inside Finally Block?+

CWE-584: Return Inside Finally Block is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

What are the security consequences of Return Inside Finally Block?+

If exploited, CWE-584 (Return Inside Finally Block) it can compromise Other, leading to outcomes such as Alter Execution Logic.

How do you prevent or mitigate Return Inside Finally Block?+

Recommended mitigations for CWE-584 include: Do not use a return statement inside the finally block. The finally block should have "cleanup" code.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-584 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More