1775
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 40 Insufficient Process Validation
References
[REF-795]Jeremiah Grossman. "Business Logic Flaws and Yahoo Games". 2006 December 8. <
https://blog.jeremiahgrossman.com/2006/12/business-logic-flaws.html >.2023-04-07.
[REF-796]Jeremiah Grossman. "Seven Business Logic Flaws That Put Your Website At Risk".
2007 October. < https://docplayer.net/10021793-Seven-business-logic-flaws-that-put-your-websiteat-
risk.html >.2023-04-07.
[REF-797]WhiteHat Security. "Business Logic Flaws". < https://web.archive.org/
web/20080720171327/http://www.whitehatsec.com/home/solutions/BL_auction.html >.2023-04-07.
[REF-806]WASC. "Insufficient Process Validation". < http://projects.webappsec.org/w/
page/13246943/Insufficient-Process-Validation >.
[REF-799]Rafal Los and Prajakta Jagdale. "Defying Logic: Theory, Design, and Implementation
of Complex Systems for Testing Application Logic". 2011. < https://www.slideshare.net/RafalLos/
defying-logic-business-logic-testing-with-automation >.2023-04-07.
[REF-667]Rafal Los. "Real-Life Example of a 'Business Logic Defect' (Screen Shots!)". 2011. <
http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-
Logic-Defect-Screen-Shots/ba-p/22581 >.
[REF-801]Viktoria Felmetsger, Ludovico Cavedon, Christopher Kruegel and Giovanni Vigna.
"Toward Automated Detection of Logic Vulnerabilities in Web Applications". USENIX Security
Symposium 2010. 2010 August. < https://www.usenix.org/legacy/events/sec10/tech/full_papers/
Felmetsger.pdf >.2023-04-07.
[REF-802]Faisal Nabi. "Designing a Framework Method for Secure Business Application Logic
Integrity in e-Commerce Systems". International Journal of Network Security, Vol.12, No.1. 2011. <
http://ijns.femto.com.tw/contents/ijns-v12-n1/ijns-2011-v12-n1-p29-41.pdf >.
CWE-842: Placement of User into Incorrect Group
Weakness ID : 842
Structure : Simple
Abstraction : Base
Description
The product or the administrator places a user into an incorrect group.
Extended Description
If the incorrect group has more access or privileges than the intended group, the user might be able
to bypass intended security policy to access unexpected resources or perform unexpected actions.
The access-control system might not be able to detect malicious usage of this group membership.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 286 Incorrect User Management 691
Relevant to the view "Software Development" (CWE-699)
CWE Version 4.14
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')