What is Omission of Security-relevant Information (CWE-223)?

TL;DR: Omission of Security-relevant Information (CWE-223) is a vulnerability where an application fails to log or display critical security details, making it difficult to trace attacks. Fix this by implementing comprehensive logging and alerting mechanisms.

What is Omission of Security-relevant Information?

Omission of Security-relevant Information (CWE-223) is a type of vulnerability where an application does not record or display information that would be important for identifying the source or nature of security incidents. As defined by the MITRE Corporation under CWE-223, and classified by the OWASP Foundation under A09:2025 - Security Logging and Alerting Failures.

Quick Summary

Omission of Security-relevant Information is a critical vulnerability that undermines an application’s ability to detect and respond to security incidents. This can lead to undetected breaches and compromised system integrity, making it difficult for organizations to meet regulatory requirements and maintain trust with users. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes

Jump to: Quick Summary · Omission of Security-relevant Information Overview · How Omission of Security-relevant Information Works · Business Impact of Omission of Security-relevant Information · Omission of Security-relevant Information Attack Scenario · How to Detect Omission of Security-relevant Information · How to Fix Omission of Security-relevant Information · Framework-Specific Fixes for Omission of Security-relevant Information · How to Ask AI to Check Your Code for Omission of Security-relevant Information · Omission of Security-relevant Information Best Practices Checklist · Omission of Security-relevant Information FAQ · Vulnerabilities Related to Omission of Security-relevant Information · References · Scan Your Own Site

Omission of Security-relevant Information Overview

What

Omission of Security-relevant Information is a vulnerability where an application fails to record or display information necessary for identifying the source and nature of security incidents.

Why it matters

This can make it difficult or impossible to trace attacks, leading to undetected breaches and compromised system integrity. It undermines accountability and compliance efforts.

Where it occurs

In any application that does not implement comprehensive logging and alerting mechanisms.

Who is affected

Developers and organizations relying on incomplete security logs for incident response and forensic analysis.

Who is NOT affected

Applications with robust security logging practices in place.

How Omission of Security-relevant Information Works

Root Cause

The root cause lies in the failure to implement comprehensive logging and alerting mechanisms that capture all relevant information about security incidents.

Attack Flow

1. An attacker initiates an attack on the system.
2. The application fails to log or display critical details necessary for identifying the source of the attack.
3. Without this information, it becomes difficult to trace the origin and nature of the attack.
4. As a result, the organization may be unable to respond effectively to the incident.

   Prerequisites to Exploit

   • An application that does not implement comprehensive logging practices.
   • Insufficient security logs capturing relevant details about incidents.

     Vulnerable Code

     def perform_action(user_id):
      # Perform action without logging necessary information
     

     This code fails to log critical details such as user IDs, timestamps, and actions performed.

Secure Code

import logging

logger = logging.getLogger(__name__)

def perform_action(user_id):
    logger.info(f"User {user_id} initiated an action.")
    # Perform action with comprehensive logging in place

This secure code ensures that all relevant information is logged for incident response and forensic analysis.

Business Impact of Omission of Security-relevant Information

Confidentiality

• Exposed data access patterns may be difficult to trace.

  Integrity

• Modifications made by attackers can go unnoticed due to lack of detailed logs.

  Availability

• System disruptions caused by attacks may not be detected in a timely manner, leading to prolonged downtime.

Omission of Security-relevant Information Attack Scenario

1. An attacker initiates an unauthorized access attempt on the system.
2. The application fails to log critical details such as user IDs and timestamps.
3. Without this information, it becomes difficult for security teams to trace back the source of the attack.
4. As a result, the organization is unable to respond effectively to the incident.

How to Detect Omission of Security-relevant Information

Manual Testing

• Review application logs to ensure all relevant details are captured.
• Verify that timestamps and user IDs are logged for each action performed.
• Check if detailed information about security incidents is recorded.

  Automated Scanners (SAST / DAST)

  Static analysis can detect missing logging statements, while dynamic testing can identify instances where critical information is not being logged during runtime.

  PenScan Detection

  PenScan’s scanner engines such as ZAP and Wapiti can help in identifying potential omissions of security-relevant information.

  False Positive Guidance

  A finding may be a false positive if the application logs sufficient details for incident response, even though it does not log every single detail.

How to Fix Omission of Security-relevant Information

• Implement comprehensive logging and alerting mechanisms that capture all relevant security-relevant information.
• Ensure timestamps, user IDs, and detailed actions are logged for each event.

Framework-Specific Fixes for Omission of Security-relevant Information

Python/Django

import logging

logger = logging.getLogger(__name__)

def perform_action(user_id):
    logger.info(f"User {user_id} initiated an action.")
    # Perform action with comprehensive logging in place

This secure code ensures that all relevant information is logged for incident response and forensic analysis.

How to Ask AI to Check Your Code for Omission of Security-relevant Information

Omission of Security-relevant Information Best Practices Checklist

• ✅ Implement comprehensive security logging mechanisms.
• ✅ Ensure timestamps, user IDs, and detailed actions are logged for each event.

Omission of Security-relevant Information FAQ

How does Omission of Security-relevant Information occur?

It occurs when an application fails to record or display information that is crucial for identifying the source or nature of security incidents, making it difficult to trace attacks and ensure actions are safe.

Why is logging important in preventing CWE-223?

Logging provides a trail of events that can help identify suspicious activities and track down attackers. Without proper logging, evidence of malicious activity may be lost or obscured.

How does Omission of Security-relevant Information impact non-repudiation?

It undermines the ability to prove who performed actions within a system, as critical details needed for accountability are missing from logs and other security records.

What steps can I take to detect Omission of Security-relevant Information in my application?

Review your logging practices to ensure all relevant information is captured. Use automated tools like PenScan to scan for vulnerabilities related to this issue.

How do I prevent CWE-223 from occurring in new code development?

Implement comprehensive security logging and alerting mechanisms that capture detailed event data, including timestamps, user IDs, actions performed, and any relevant environmental context.

What are the business consequences of Omission of Security-relevant Information?

It can lead to financial losses due to undetected breaches, compliance issues from failing to meet regulatory requirements for logging, and reputational damage if security incidents go unnoticed.

How does PenScan help in mitigating CWE-223 risks?

PenScan’s automated scanners identify potential omissions of security-relevant information by analyzing your application’s logs and configurations.

Vulnerabilities Related to Omission of Security-relevant Information

| CWE | Name | Relationship | |—|—|—| | CWE-221 | Information Loss or Omission (ChildOf) |

References

• MITRE
• OWASP - Security Logging and Alerting Failures
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Omission of Security-relevant Information and other risks before an attacker does.