Vendor dan Produk

CPE, singkatan dari Common Platform Enumeration, adalah skema standar untuk penamaan perangkat keras, perangkat lunak, dan sistem operasi. CPE menyediakan skema penamaan terstruktur untuk mengidentifikasi dan mengklasifikasikan sistem teknologi informasi, platform, dan paket secara unik berdasarkan atribut tertentu seperti vendor, nama produk, versi, pembaruan, edisi, dan bahasa.

Nama: Improper Control of Interaction Frequency

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Informasi Umum

Mode Pengenalan

Architecture and Design
Implementation
Operation

Platform yang Berlaku

Bahasa

Kelas: Not Language-Specific (Undetermined)

Teknologi

Kelas: Not Technology-Specific (Undetermined)
Kelas: Web Based (Undetermined)
Nama: Web Server (Undetermined)

Konsekuensi Umum

Cakupan	Dampak	Kemungkinan
Availability Access Control Other	DoS: Resource Consumption (Other), Bypass Protection Mechanism, Varies by Context Catatan: This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. The consequences vary based on the intended logic of the code. For example, humans might be able to vote multiple times in a poll, or to perform password-guessing attacks without any rate limits.

Contoh yang Diamati

Referensi	Deskripsi
CVE-2024-50653	Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799)
CVE-2002-1876	Mail server allows attackers to prevent other users from accessing mail by sending a large number of rapid requests.

Catatan Pemetaan Kerentanan

Justifikasi : This CWE entry is a Class and might have Base-level children that would be more appropriate
Komentar : Examine children of this entry to see if there is a better fit

Referensi

REF-731

Insufficient Anti-automation
Web Application Security Consortium.
http://projects.webappsec.org/Insufficient+Anti-automation

Pengajuan

Nama	Organisasi	Tanggal	Tanggal rilis	Version
CWE Content Team	MITRE	2010-01-15 +00:00	2010-02-16 +00:00	1.8

Modifikasi

Nama	Organisasi	Tanggal	Komentar
CWE Content Team	MITRE	2010-04-05 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2011-03-29 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2017-11-08 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Observed_Examples, Relationships
CWE Content Team	MITRE	2026-10-28 +00:00	updated Alternate_Terms, Common_Consequences, Description, Observed_Examples

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.

Detail CWE-799

CWE-799