Incomplete Internal State Distinction

Opis

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Skutki

• Integrity, Other

  Varies by Context; Unexpected State

Słabość nadrzędna

• CWE-664 Improper Control of a Resource Through its Lifetime

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Uwagi

This conceptually overlaps other categories such as insufficient verification, but this entry refers to the product's incorrect perception of its own state.

This is probably resultant from other weaknesses such as unhandled error conditions, inability to handle out-of-order steps, multiple interpretation errors, etc.

This entry is being considered for deprecation. It was poorly-defined in PLOVER and is not easily described using the behavior/resource/property model of vulnerability theory.