简体中文

CWE-408 详情

CWE-408

Incorrect Behavior Order: Early Amplification
2006-07-19
00h00 +00:00
Draft
2025-12-11
00h00 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Incorrect Behavior Order: Early Amplification

The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.

基本信息

引入方式

Architecture and Design
Implementation

适用平台

编程语言

类： Not Language-Specific (Undetermined)

常见后果

影响范围 影响 可能性
AvailabilityDoS: Amplification, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory)

注意： System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.

观察示例

参考资料 描述

CVE-2004-2458

Tool creates directories before authenticating user.

漏洞映射说明

依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

备注

Overlaps authentication errors.

提交记录

名称 组织 日期 发布日期 Version
PLOVER 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

修改记录

名称 组织 日期 备注
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team MITRE 2009-05-27 +00:00 updated Description
CWE Content Team MITRE 2010-06-21 +00:00 updated Other_Notes, Relationship_Notes
CWE Content Team MITRE 2011-03-29 +00:00 updated Demonstrative_Examples, Observed_Examples, Relationships
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Relationships
CWE Content Team MITRE 2014-07-30 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Applicable_Platforms
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2023-01-31 +00:00 updated Demonstrative_Examples, Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Weakness_Ordinalities
cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。