CWE-799
Improper Control of Interaction Frequency
2010-02-16
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Improper Control of Interaction Frequency
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
一般資訊
引入方式
Architecture and DesignImplementation
Operation
適用平台
程式語言
類別： Not Language-Specific (Undetermined)技術
類別： Not Technology-Specific (Undetermined)類別： Web Based (Undetermined)
名稱： Web Server (Undetermined)
常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Availability Access Control Other | DoS: Resource Consumption (Other), Bypass Protection Mechanism, Varies by Context 注意：This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. The consequences vary based on the intended logic of the code. For example, humans might be able to vote multiple times in a poll, or to perform password-guessing attacks without any rate limits. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2024-50653 | Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799) |
CVE-2002-1876 | Mail server allows attackers to prevent other users from accessing mail by sending a large number of rapid requests. |
漏洞對應備注
理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate備註 : Examine children of this entry to see if there is a better fit
參考資料
REF-731
Insufficient Anti-automationWeb Application Security Consortium.
http://projects.webappsec.org/Insufficient+Anti-automation
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 1.8 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Alternate_Terms, Common_Consequences, Description, Observed_Examples |
