CWE-778 不充分的日志记录

Insufficient Logging

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: Medium


When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.


When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds.


  • cwe_Nature: ChildOf cwe_CWE_ID: 223 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 223 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 693 cwe_View_ID: 1000


Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}


范围 影响 注释
Non-Repudiation Hide Activities If security critical information is not recorded, there will be no trail for forensic analysis and discovering the cause of problems or the source of attacks may become more difficult or impossible.


Architecture and Design


Use a centralized logging mechanism that supports multiple levels of detail. Ensure that all security-related successes and failures can be logged.



Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks. At the same time, logging too much data (CWE-779) can cause the same problems.


The example below shows a configuration for the service security audit feature in the Windows Communication Foundation (WCF).

bad XML

<behavior name="NewBehavior">
<serviceSecurityAudit auditLogLocation="Default"
messageAuthenticationAuditLevel="None" />


The previous configuration file has effectively disabled the recording of security-critical events, which would force the administrator to look to other sources during debug or recovery efforts.

Logging failed authentication attempts can warn administrators of potential brute force attacks. Similarly, logging successful authentication events can provide a useful audit trail when a legitimate account is compromised. The following configuration shows appropriate settings, assuming that the site does not have excessive traffic, which could fill the logs if there are a large number of success or failure events (CWE-779).

good XML

<behavior name="NewBehavior">
<serviceSecurityAudit auditLogLocation="Default"
messageAuthenticationAuditLevel="SuccessAndFailure" />



标识 说明 链接
CVE-2008-4315 server does not log failed authentication attempts, making it easier for attackers to perform brute force password guessing without being detected
CVE-2008-1203 admin interface does not log failed authentication attempts, making it easier for attackers to perform brute force password guessing without being detected
CVE-2007-3730 default configuration for POP server does not log source IP or username for login attempts
CVE-2007-1225 proxy does not log requests without "http://" in the URL, allowing web surfers to access restricted web content without detection
CVE-2003-1566 web server does not log requests for a non-standard request type