Incorrect Behavior Order

Opis

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Skutki

• Integrity

  Alter Execution Logic

Przykłady podatności

• CVE-2019-9805 Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
• CVE-2007-5191 file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges
• CVE-2007-1588 C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended
• CVE-2022-37734 Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)

Słabość nadrzędna

• CWE-691 Insufficient Control Flow Management

Słabości podrzędne

• CWE-179 Incorrect Behavior Order: Early Validation
• CWE-408 Incorrect Behavior Order: Early Amplification
• CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
• CWE-1190 DMA Device Enabled Too Early in Boot Phase
• CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
• CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready
• CWE-1280 Access Control Check Implemented After Asset is Accessed

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based