CWE-221, Information Loss or Omission, is a class-level weakness. The product does not record, or improperly records, security-relevant information, which leads to a wrong decision or hampers later analysis.
It is the parent of more specific entries about truncation (CWE-222), omission (CWE-223) and recording under an alternate name (CWE-224). If you are building logging, auditing or any display that people use to judge whether something is safe, it applies.
How it happens
Information goes missing in a few ways, and the observed CVEs show each of them:
- Truncated display. CVE-2004-2227: a browser's file selection dialog shows only the start of long file names, which can trick users into launching executables with dangerous extensions.
- Truncated logs. CVE-2003-0412: an application server does not log the complete URI of a long request.
- Events never recorded. CVE-1999-1029: login attempts are not recorded if the user disconnects before the maximum number of tries.
- Wrong name recorded. CVE-2002-0725: an attacker acts on a hard link to a file, which obscures the real target file.
What an attacker gains
MITRE lists non-repudiation: the attacker can hide activities. Without accurate records, the source and nature of an attack are hard to establish, and the attack can continue unnoticed.
How to find it
MITRE lists no detection methods. Review by asking, for each security decision and each log line: what would an investigator need to know, and is it all there?
- Run abusive cases on purpose: very long inputs, early disconnects, repeated failures. Then read the logs.
- Check that the recorded identity is the canonical one, not an alias.
- Check that user-facing prompts show the part of a name that matters, such as the file extension.
How to fix it
MITRE gives no mitigations for this entry. Practical steps follow from the cases above: log complete values or an explicit marker that a value was cut, record failed events even when the session ends early, and record canonical names. Keep secrets out of logs while you do it.
Quick check
Is a truncated log line a security problem?
It can be. If the part cut off held the attack payload or its source, the record no longer shows what happened.
