1763
In various applications, a user is only expected to perform a certain action once, such as voting,
requesting a refund, or making a purchase. When this restriction is not enforced, sometimes this
can have security implications. For example, in a voting application, an attacker could attempt
to "stuff the ballot box" by voting multiple times. If these votes are counted separately, then the
attacker could directly affect who wins the vote. This could have significant business impact
depending on the purpose of the product.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 799 Improper Control of Interaction Frequency 1699
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 438 Behavioral Problems 2326
MemberOf 840 Business Logic Errors 2360
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
An attacker might be able to gain advantage over other
users by performing the action multiple times, or affect the
correctness of the product.
Observed Examples
Reference Description
CVE-2008-0294 Ticket-booking web application allows a user to lock a seat more than once.
https://www.cve.org/CVERecord?id=CVE-2008-0294
CVE-2005-4051 CMS allows people to rate downloads by voting more than once.
https://www.cve.org/CVERecord?id=CVE-2005-4051
CVE-2002-216 Polling software allows people to vote more than once by setting a cookie.
https://www.cve.org/CVERecord?id=CVE-2002-216
CVE-2003-1433 Chain: lack of validation of a challenge key in a game allows a player to
register multiple times and lock other players out of the game.
https://www.cve.org/CVERecord?id=CVE-2003-1433
CVE-2002-1018 Library feature allows attackers to check out the same e-book multiple times,
preventing other users from accessing copies of the e-book.
https://www.cve.org/CVERecord?id=CVE-2002-1018
CVE-2009-2346 Protocol implementation allows remote attackers to cause a denial of service
(call-number exhaustion) by initiating many message exchanges.
https://www.cve.org/CVERecord?id=CVE-2009-2346
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-838: Inappropriate Encoding for Output Context
CWE-838: Inappropriate Encoding for Output Context