1772
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-841: Improper Enforcement of Behavioral Workflow
Weakness ID : 841
Structure : Simple
Abstraction : Base
Description
The product supports a session in which more than one behavior must be performed by an actor,
but it does not properly ensure that the actor performs the behaviors in the required sequence.
Extended Description
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate
the business logic of the product or cause it to enter an invalid state. In some cases, this can also
expose resultant weaknesses.
For example, a file-sharing protocol might require that an actor perform separate steps to provide
a username, then a password, before being able to transfer files. If the file-sharing server accepts
a password command followed by a transfer command, without any username being provided, the
product might still perform the transfer.
Note that this is different than CWE-696, which focuses on when the product performs actions
in the wrong sequence; this entry is closely related, but it is focused on ensuring that the actor
performs actions in the correct sequence.
Workflow-related behaviors include:
• Steps are performed in the expected order.
• Required steps are not omitted.
• Steps are not interrupted.
• Steps are performed in a timely fashion.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 691 Insufficient Control Flow Management 1517
CWE Version 4.14
CWE-841: Improper Enforcement of Behavioral Workflow
CWE-841: Improper Enforcement of Behavioral Workflow