名稱: Incomplete Internal State Distinction

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

一般資訊

引入方式

Implementation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

常見後果

範圍	影響	可能性
Integrity Other	Varies by Context, Unexpected State

漏洞對應備注

理由說明 : This CWE entry could be deprecated in a future version of CWE.
備註 : See maintenance notes.

相關攻擊模式

CAPEC ID	攻擊模式名稱
CAPEC-140	Bypassing of Intermediate Forms in Multiple-Form Sets Some web applications require users to submit information through an ordered sequence of web forms. This is often done if there is a very large amount of information being collected or if information on earlier forms is used to pre-populate fields or determine which additional information the application needs to collect. An attacker who knows the names of the various forms in the sequence may be able to explicitly type in the name of a later form and navigate to it without first going through the previous forms. This can result in incomplete collection of information, incorrect assumptions about the information submitted by the attacker, or other problems that can impair the functioning of the application.
CAPEC-74	Manipulating State

備注

This conceptually overlaps other categories such as insufficient verification, but this entry refers to the product's incorrect perception of its own state.
This is probably resultant from other weaknesses such as unhandled error conditions, inability to handle out-of-order steps, multiple interpretation errors, etc.
This entry is being considered for deprecation. It was poorly-defined in PLOVER and is not easily described using the behavior/resource/property model of vulnerability theory.

提交

名稱	機構	日期	發布日期	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改記錄

名稱	機構	日期	備註
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Maintenance_Notes, Relationships, Relationship_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2010-12-13 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-06-27 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-05-03 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2018-03-27 +00:00	updated Maintenance_Notes, Relationships
CWE Content Team	MITRE	2019-06-20 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Type

CWE-372 詳細資料

CWE-372