Incorrect Behavior Order: Early Amplification

Opis

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

Skutki

• Availability

  DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)

  System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

Przykłady podatności

• CVE-2004-2458 Tool creates directories before authenticating user.

Słabość nadrzędna

• CWE-405 Asymmetric Resource Consumption (Amplification)
• CWE-696 Incorrect Behavior Order

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific

Uwagi

Overlaps authentication errors.