1774
Reference Description
CVE-2011-0348 Bypass of access/billing restrictions by sending traffic to an unrestricted
destination before sending to a restricted destination.
https://www.cve.org/CVERecord?id=CVE-2011-0348
CVE-2007-3012 Attacker can access portions of a restricted page by canceling out of a dialog.
https://www.cve.org/CVERecord?id=CVE-2007-3012
CVE-2009-5056 Ticket-tracking system does not enforce a permission setting.
https://www.cve.org/CVERecord?id=CVE-2009-5056
CVE-2004-2164 Shopping cart does not close a database connection when user restores a
previous order, leading to connection exhaustion.
https://www.cve.org/CVERecord?id=CVE-2004-2164
CVE-2003-0777 Chain: product does not properly handle dropped connections, leading to
missing NULL terminator (CWE-170) and segmentation fault.
https://www.cve.org/CVERecord?id=CVE-2003-0777
CVE-2005-3327 Chain: Authentication bypass by skipping the first startup step as required by
the protocol.
https://www.cve.org/CVERecord?id=CVE-2005-3327
CVE-2004-0829 Chain: File server crashes when sent a "find next" request without an initial
"find first."
https://www.cve.org/CVERecord?id=CVE-2004-0829
CVE-2010-2620 FTP server allows remote attackers to bypass authentication by sending
(1) LIST, (2) RETR, (3) STOR, or other commands without performing the
required login steps first.
https://www.cve.org/CVERecord?id=CVE-2010-2620
CVE-2005-3296 FTP server allows remote attackers to list arbitrary directories as root by
running the LIST command before logging in.
https://www.cve.org/CVERecord?id=CVE-2005-3296
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Notes
Research Gap
This weakness is typically associated with business logic flaws, except when it produces
resultant weaknesses. The classification of business logic flaws has been under-studied,
although exploitation of business flaws frequently happens in real-world systems, and many
applied vulnerability researchers investigate them. The greatest focus is in web applications.
There is debate within the community about whether these problems represent particularly new
concepts, or if they are variations of well-known principles. Many business logic flaws appear
to be oriented toward business processes, application flows, and sequences of behaviors,
which are not as well-represented in CWE as weaknesses related to input validation, memory
management, etc.
Taxonomy Mappings
CWE Version 4.14
CWE-842: Placement of User into Incorrect Group
CWE-842: Placement of User into Incorrect Group