CWE-7: J2EE Misconfiguration: Missing Custom Error Page

CWE-7: J2EE Misconfiguration: Missing Custom Error Page is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The default error page of a web application should not display sensitive information about the product. A Web application must define a default error page for 4xx errors (e.g. 404), 5xx (e.g. 500) errors and catch java.lang.Throwable exceptions to prevent attackers from mining information from the application container's built-in error response. When an attacker explores a web site looking for vulnerabilities, the amount of information that the site provides is crucial to the eventual success or failure of any attempted attacks.

If exploited, CWE-7 (J2EE Misconfiguration: Missing Custom Error Page) it can compromise Confidentiality, leading to outcomes such as Read Application Data.

Recommended mitigations for CWE-7 include: Handle exceptions appropriately in source code. Always define appropriate error pages. The application configuration should specify a default error page in order to guarantee that the application will never leak error messages to an attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a good security practice, and a good configuration will also define a last-chance error handler that catches any exception that could possibly be thrown by the application. Do not attempt to process an error or attempt to mask it.

CWE-7 commonly affects Java. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

A CWE (Common Weakness Enumeration) like CWE-7 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.