Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-372:Incomplete Internal State Distinction
Weakness ID:372
Version:v4.17
Weakness Name:Incomplete Internal State Distinction
Vulnerability Mapping:Discouraged
Abstraction:Base
Structure:Simple
Status:Draft
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

▼Extended Description

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfDiscouragedP664Improper Control of a Resource Through its Lifetime
Nature: ChildOf
Mapping: Discouraged
Type: Pillar
ID: 664
Name: Improper Control of a Resource Through its Lifetime
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC371State Issues
MemberOfProhibitedC962SFP Secondary Cluster: Unchecked Status Condition
MemberOfProhibitedC1416Comprehensive Categorization: Resource Lifecycle Management
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 371
Name: State Issues
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 962
Name: SFP Secondary Cluster: Unchecked Status Condition
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1416
Name: Comprehensive Categorization: Resource Lifecycle Management
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-315Unexpected State (impact)
MemberOfProhibitedBSBOSS-326Varies by Context (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-315
Name: Unexpected State (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-326
Name: Varies by Context (impact)
▼Relevant To View
Relevant to the view"Software Development - (699)"
NatureMappingTypeIDName
MemberOfProhibitedC371State Issues
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 371
Name: State Issues
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC962SFP Secondary Cluster: Unchecked Status Condition
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 962
Name: SFP Secondary Cluster: Unchecked Status Condition
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
IntegrityOtherN/AVaries by ContextUnexpected State
N/A
Scope: Integrity, Other
Likelihood: N/A
Impact: Varies by Context, Unexpected State
Note:
N/A
▼Potential Mitigations
▼Modes Of Introduction
Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Discouraged
      Reason:Potential Deprecation, CWE Overlap
      Rationale:

      This CWE entry could be deprecated in a future version of CWE.

      Comments:

      See maintenance notes.

      Suggestions:
      ▼Notes
      Relationship

      This conceptually overlaps other categories such as insufficient verification, but this entry refers to the product's incorrect perception of its own state.

      N/A

      Relationship

      This is probably resultant from other weaknesses such as unhandled error conditions, inability to handle out-of-order steps, multiple interpretation errors, etc.

      N/A

      Maintenance

      This entry is being considered for deprecation. It was poorly-defined in PLOVER and is not easily described using the behavior/resource/property model of vulnerability theory.

      N/A

      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      PLOVERN/AN/AIncomplete Internal State Distinction
      Taxonomy Name: PLOVER
      Entry ID: N/A
      Fit: N/A
      Entry Name: Incomplete Internal State Distinction
      ▼Related Attack Patterns
      IDName
      CAPEC-140
      Bypassing of Intermediate Forms in Multiple-Form Sets
      CAPEC-74
      Manipulating State
      ID: CAPEC-140
      Name: Bypassing of Intermediate Forms in Multiple-Form Sets
      ID: CAPEC-74
      Name: Manipulating State
      ▼References
      Details not found