What is Detection of Error Condition Without (CWE-390)?

TL;DR: Detection of Error Condition Without Action (CWE-390) is a vulnerability where an error condition is detected but not handled. This can lead to unexpected system states and data corruption.

What is Detection of Error Condition Without Action?

Detection of Error Condition Without Action (CWE-390) is a type of vulnerability that occurs when an error condition is detected but no action is taken to handle the error. As defined by the MITRE Corporation under CWE-390, and classified by the OWASP Foundation under A10:2025 - Mishandling of Exceptional Conditions.

Quick Summary

Detection of Error Condition Without Action can lead to unexpected system states, data corruption, or even security vulnerabilities if an error condition is ignored without proper handling. This vulnerability affects any backend language and can be detected through comprehensive testing strategies and static analysis tools.

Jump to: Quick Summary · Detection of Error Condition Without Action Overview · How Detection of Error Condition Without Action Works · Business Impact of Detection of Error Condition Without Action · Detection of Error Condition Without Action Attack Scenario · How to Detect Detection of Error Condition Without Action · How to Fix Detection of Error Condition Without Action · Framework-Specific Fixes for Detection of Error Condition Without Action · How to Ask AI to Check Your Code for Detection of Error Condition Without Action · Detection of Error Condition Without Action Best Practices Checklist · Detection of Error Condition Without Action FAQ · Vulnerabilities Related to Detection of Error Condition Without Action · References · Scan Your Own Site

Detection of Error Condition Without Action Overview

What: A software vulnerability where an error condition is detected but not handled properly.

Why it matters: It can lead to unexpected behavior, data corruption, or security vulnerabilities if the system state becomes unpredictable due to unhandled errors.

Where it occurs: Any backend language that does not handle exceptions and return values appropriately.

Who is affected: Developers who do not implement proper error handling mechanisms in their code.

Who is NOT affected: Applications that properly handle all detected errors and maintain a predictable system state.

How Detection of Error Condition Without Action Works

Root Cause

The root cause is the lack of proper exception handling or return value processing, leading to an ignored error condition.

Attack Flow

1. An error condition is detected.
2. No action is taken to handle the error.
3. The system continues execution in an unexpected state.

Prerequisites to Exploit

• The application must not have any mechanism to handle errors.
• The error condition must be detectable and ignored by the code.

Vulnerable Code

def process_data(data):
    try:
        result = some_function_that_may_fail(data)
    except Exception as e:
        # Error detected but no action taken

This code detects an error but does not handle it, leading to potential issues.

Secure Code

def process_data(data):
    try:
        result = some_function_that_may_fail(data)
    except Exception as e:
        log_error(e)  # Log the error for debugging purposes
        raise  # Re-raise the exception or take appropriate action

The secure code ensures that any detected errors are logged and handled properly.

Business Impact of Detection of Error Condition Without Action

Confidentiality: Data may be exposed due to unexpected system states caused by unhandled errors. Integrity: System integrity can be compromised if data is modified or corrupted due to unhandled exceptions. Availability: The availability of the application may be affected if it continues running in an unstable state.

• Financial loss from downtime and recovery efforts.
• Compliance issues due to unauthorized access or data breaches.
• Reputation damage from service interruptions and security incidents.

Detection of Error Condition Without Action Attack Scenario

1. An error condition is detected during a critical operation.
2. The application ignores the error and continues execution.
3. This leads to unexpected behavior, such as data corruption or system instability.

How to Detect Detection of Error Condition Without Action

Manual Testing

• Check for try-catch blocks that do not handle exceptions properly.
• Verify if all return values are checked and handled appropriately.

Automated Scanners (SAST / DAST)

Static analysis tools can detect unhandled exceptions, while dynamic testing is needed to confirm the actual impact in runtime scenarios.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap are used to identify this vulnerability.

False Positive Guidance

A false positive occurs if an exception is handled correctly but the tool flags it due to incomplete context understanding. Ensure that any detected issue is actually ignored without proper handling.

How to Fix Detection of Error Condition Without Action

• Properly handle each exception.
• Alert the user and either fix the problem or close/cleanup the program.
• Subject the product to extensive testing to discover unhandled errors.

Framework-Specific Fixes for Detection of Error Condition Without Action

Python/Django

def process_data(data):
    try:
        result = some_function_that_may_fail(data)
    except Exception as e:
        log_error(e)  # Log the error and handle it appropriately

Java

public void processData(String data) {
    try {
        String result = someFunctionThatMayFail(data);
    } catch (Exception e) {
        logger.error("Error occurred", e);  // Log the error and re-throw or handle accordingly
    }
}

How to Ask AI to Check Your Code for Detection of Error Condition Without Action

Detection of Error Condition Without Action Best Practices Checklist

✅ Ensure all detected errors are properly handled. ✅ Log exceptions for debugging purposes. ✅ Verify that system state remains predictable after an exception occurs.

Detection of Error Condition Without Action FAQ

How does detection of error condition without action occur in code?

An error is detected but not handled, leading to unexpected system states and potential security vulnerabilities.

What are the consequences of mishandling errors in software applications?

It can lead to unexpected behavior, data corruption, or even unauthorized access to sensitive information.

How do you detect detection of error condition without action in code reviews?

Look for places where exceptions or return values are ignored without proper handling mechanisms.

What is the best practice for preventing detection of error condition without action?

Ensure all detected errors are properly handled and that system state remains predictable after an exception occurs.

How can you fix detection of error condition without action in existing codebases?

add appropriate error handling logic to ensure exceptions do not go unaddressed.

What tools or techniques should be used to detect this issue during development?

Use static analysis tools and comprehensive testing strategies, including ad hoc and equivalence partitioning.

Can you provide an example of detection of error condition without action in a real-world application?

A function that detects an invalid input but continues execution without notifying the user or fixing the issue.

Vulnerabilities Related to Detection of Error Condition Without Action

References

• MITRE: Detection of Error Condition Without Action
• OWASP A10:2025 - Mishandling of Exceptional Conditions
• NVD NIST Vulnerabilities Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Detection of Error Condition Without Action and other risks before an attacker does.