CWE-799
Improper Control of Interaction Frequency
2010-02-16
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Improper Control of Interaction Frequency
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
基本信息
引入方式
Architecture and DesignImplementation
Operation
适用平台
编程语言
类： Not Language-Specific (Undetermined)技术
类： Not Technology-Specific (Undetermined)类： Web Based (Undetermined)
名称： Web Server (Undetermined)
常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Availability Access Control Other | DoS: Resource Consumption (Other), Bypass Protection Mechanism, Varies by Context 注意： This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. The consequences vary based on the intended logic of the code. For example, humans might be able to vote multiple times in a poll, or to perform password-guessing attacks without any rate limits. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2024-50653 | Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799) |
CVE-2002-1876 | Mail server allows attackers to prevent other users from accessing mail by sending a large number of rapid requests. |
漏洞映射说明
依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate备注 : Examine children of this entry to see if there is a better fit
参考资料
REF-731
Insufficient Anti-automationWeb Application Security Consortium.
http://projects.webappsec.org/Insufficient+Anti-automation
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.8 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Alternate_Terms, Common_Consequences, Description, Observed_Examples |
