Weakness ID: 696
Vulnerability Mapping: ALLOWED This CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review (with careful review of mapping notes)Abstraction: Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource.
Description
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
Common Consequences
This table specifies different individual consequences
associated with the weakness. The Scope identifies the application security area that is
violated, while the Impact describes the negative technical impact that arises if an
adversary succeeds in exploiting this weakness. The Likelihood provides information about
how likely the specific consequence is expected to be seen relative to the other
consequences in the list. For example, there may be high likelihood that a weakness will be
exploited to achieve a certain impact, but a low likelihood that it will be exploited to
achieve a different impact.
| Impact | Details |
|---|---|
|
Alter Execution Logic |
Scope: Integrity |
Relationships
This table shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition,
relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user
may want to explore.
Relevant to the view "Research Concepts" (View-1000)
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
|
691 | Insufficient Control Flow Management |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
179 | Incorrect Behavior Order: Early Validation |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
408 | Incorrect Behavior Order: Early Amplification |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1190 | DMA Device Enabled Too Early in Boot Phase |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1193 | Power-On of Untrusted Execution Core Before Enabling Fabric Access Control |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1279 | Cryptographic Operations are run Before Supporting Units are Ready |
| ParentOf |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource.
|
1280 | Access Control Check Implemented After Asset is Accessed |
Modes
Of Introduction
The different Modes of Introduction provide information
about how and when this
weakness may be introduced. The Phase identifies a point in the life cycle at which
introduction
may occur, while the Note provides a typical scenario related to introduction during the
given
phase.
| Phase | Note |
|---|---|
| Architecture and Design | |
| Implementation |
Applicable Platforms
This listing shows possible areas for which the given
weakness could appear. These
may be for specific named Languages, Operating Systems, Architectures, Paradigms,
Technologies,
or a class of such platforms. The platform is listed along with how frequently the given
weakness appears for that instance.
| Languages |
Class: Not Language-Specific (Undetermined Prevalence) |
| Technologies |
Class: Not Technology-Specific (Undetermined Prevalence) Class: Web Based (Undetermined Prevalence) |
Demonstrative Examples
Example 1
The following code attempts to validate a given input path by checking it against an allowlist and then return the canonical path. In this specific case, the path is considered valid if it starts with the string "/safe_dir/".
(bad code)
Example Language: Java
String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
File f = new File(path);
return f.getCanonicalPath();
}
The problem with the above code is that the validation step occurs before canonicalization occurs. An attacker could provide an input path of "/safe_dir/../" that would pass the validation step. However, the canonicalization process sees the double dot as a traversal to the parent directory and hence when canonicized the path would become just "/".
To avoid this problem, validation should occur after canonicalization takes place. In this case canonicalization occurs during the initialization of the File object. The code below fixes the issue.
(good code)
Example Language: Java
String path = getInputPath();
File f = new File(path);
if (f.getCanonicalPath().startsWith("/safe_dir/"))
{
return f.getCanonicalPath();
}
Example 2
This function prints the contents of a specified file requested by a user.
(bad code)
Example Language: PHP
function printFile($username,$filename){
//read file into string
$file = file_get_contents($filename);
if ($file && isOwnerOf($username,$filename)){
echo $file;
return true;
}
else{
echo 'You are not authorized to view this file';
}
return false;
}
This code first reads a specified file into memory, then prints the file if the user is authorized to see its contents. The read of the file into memory may be resource intensive and is unnecessary if the user is not allowed to see the file anyway.
Example 3
Assume that the module foo_bar implements a protected register. The register content is the asset. Only transactions made by user id (indicated by signal usr_id) 0x4 are allowed to modify the register contents. The signal grant_access is used to provide access.
(bad code)
Example Language: Verilog
module foo_bar(data_out, usr_id, data_in, clk, rst_n);
output reg [7:0] data_out;
input wire [2:0] usr_id;
input wire [7:0] data_in;
input wire clk, rst_n;
wire grant_access;
always @ (posedge clk or negedge rst_n)
begin
if (!rst_n)
data_out = 0;
else
data_out = (grant_access) ? data_in : data_out;
assign grant_access = (usr_id == 3'h4) ? 1'b1 : 1'b0;
end
endmodule
This code uses Verilog blocking assignments for data_out and grant_access. Therefore, these assignments happen sequentially (i.e., data_out is updated to new value first, and grant_access is updated the next cycle) and not in parallel. Therefore, the asset data_out is allowed to be modified even before the access control check is complete and grant_access signal is set. Since grant_access does not have a reset value, it will be meta-stable and will randomly go to either 0 or 1.
Flipping the order of the assignment of data_out and grant_access should solve the problem. The correct snippet of code is shown below.
(good code)
Example Language: Verilog
always @ (posedge clk or negedge rst_n)
begin
if (!rst_n)
data_out = 0;
else
assign grant_access = (usr_id == 3'h4) ? 1'b1 : 1'b0;
data_out = (grant_access) ? data_in : data_out;
end
endmodule
Selected Observed
Examples
Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.
| Reference | Description |
|---|---|
|
Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption. |
|
|
file-system management programs call the setuid and setgid functions in the wrong order and do not check the return values, allowing attackers to gain unintended privileges |
|
|
C++ web server program calls Process::setuid before calling Process::setgid, preventing it from dropping privileges, potentially allowing CGI programs to be called with higher privileges than intended |
|
|
Chain: lexer in Java-based GraphQL server does not enforce maximum of tokens early enough (CWE-696), allowing excessive CPU consumption (CWE-1176) |
Weakness Ordinalities
| Ordinality | Description |
|---|---|
|
Primary |
(where the weakness exists independent of other weaknesses) |
Memberships
This MemberOf Relationships table shows additional CWE Categories and Views that
reference this weakness as a member. This information is often useful in understanding where a
weakness fits within the context of external information sources.
| Nature | Type | ID | Name |
|---|---|---|---|
| MemberOf |  Category - a CWE entry that contains a set of other entries that share a common characteristic. |
748 | CERT C Secure Coding Standard (2008) Appendix - POSIX (POS) |
| MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. |
977 | SFP Secondary Cluster: Design |
| MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1171 | SEI CERT C Coding Standard - Guidelines 50. POSIX (POS) |
| MemberOf | Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1410 | Comprehensive Categorization: Insufficient Control Flow Management |
Vulnerability Mapping Notes
| Usage |
ALLOWED-WITH-REVIEW
(this CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review) |
| Reason | Abstraction |
|
Rationale |
This CWE entry is a Class and might have Base-level children that would be more appropriate |
|
Comments |
Examine children of this entry to see if there is a better fit |
Taxonomy
Mappings
| Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|---|---|---|
| CERT C Secure Coding | POS36-C | CWE More Abstract | Observe correct revocation order while relinquishing privileges |
Content
History
| Submissions |
||
|---|---|---|
| Submission Date | Submitter | Organization |
|
2008-09-09
(CWE 1.0, 2008-09-09) |
CWE Content Team | MITRE |
 Modifications |
||
| Modification Date | Modifier | Organization |
|
2025-12-11
(CWE 4.19, 2025-12-11) |
CWE Content Team | MITRE |
| updated Applicable_Platforms, Description | ||
|
2025-04-03
(CWE 4.17, 2025-04-03) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2024-02-29
(CWE 4.14, 2024-02-29) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples | ||
|
2023-10-26
(CWE 4.13, 2023-10-26) |
CWE Content Team | MITRE |
| updated Demonstrative_Examples, Observed_Examples | ||
|
2023-06-29
(CWE 4.12, 2023-06-29) |
CWE Content Team | MITRE |
| updated Mapping_Notes | ||
|
2023-04-27
(CWE 4.11, 2023-04-27) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2021-03-15
(CWE 4.4, 2021-03-15) |
CWE Content Team | MITRE |
| updated Observed_Examples | ||
|
2020-06-25
(CWE 4.1, 2020-06-25) |
CWE Content Team | MITRE |
| updated Description, Observed_Examples, Relationships | ||
|
2020-02-24
(CWE 4.0, 2020-02-24) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2019-01-03
(CWE 3.2, 2019-01-03) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2017-11-08
(CWE 3.0, 2017-11-08) |
CWE Content Team | MITRE |
| updated Taxonomy_Mappings | ||
|
2017-05-03
(CWE 2.11, 2017-05-05) |
CWE Content Team | MITRE |
| updated Observed_Examples | ||
|
2014-07-30
(CWE 2.8, 2014-07-31) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2012-05-11
(CWE 2.2, 2012-05-15) |
CWE Content Team | MITRE |
| updated Related_Attack_Patterns, Relationships, Weakness_Ordinalities | ||
|
2011-06-27
(CWE 2.0, 2011-06-27) |
CWE Content Team | MITRE |
| updated Common_Consequences | ||
|
2011-06-01
(CWE 1.13, 2011-06-01) |
CWE Content Team | MITRE |
| updated Common_Consequences | ||
|
2011-03-29
(CWE 1.12, 2011-03-30) |
CWE Content Team | MITRE |
| updated Relationships | ||
|
2009-05-27
(CWE 1.4, 2009-05-27) |
CWE Content Team | MITRE |
| updated Description | ||
|
2008-11-24
(CWE 1.1, 2008-11-25) |
CWE Content Team | MITRE |
| updated Relationships, Taxonomy_Mappings | ||