Nama: Incorrect Behavior Order

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)
Kelas: Web Based (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Integrity	Alter Execution Logic

Contoh yang Diamati

Referensi	Deskripsi
CVE-2019-9805	Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
CVE-2007-5191	file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges
CVE-2007-1588	C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended
CVE-2022-37734	Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176)

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is a Class and might have Base-level children that would be more appropriate
Komentar : Examine children of this entry to see if there is a better fit

Pola Serangan Terkait

CAPEC ID	Nama Pola Serangan
CAPEC-463	Padding Oracle Crypto Attack An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
CWE Content Team	MITRE	2008-09-09 +00:00	2008-09-09 +00:00	1.0

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2008-11-24 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2009-05-27 +00:00	updated Description
CWE Content Team	MITRE	2011-03-29 +00:00	updated Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-06-27 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Related_Attack_Patterns, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-05-03 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2017-11-08 +00:00	updated Taxonomy_Mappings
CWE Content Team	MITRE	2019-01-03 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2020-06-25 +00:00	updated Description, Observed_Examples, Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Demonstrative_Examples, Observed_Examples
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2025-04-03 +00:00	updated Relationships
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Description

Detail CWE-696

CWE-696