1505
produces the correct results or if the provided argument type is very similar to the expected
argument type.
Demonstrative Examples
Example 1:
The following PHP method authenticates a user given a username/password combination but is
called with the parameters in reverse order.
Example Language: PHP (Bad)
function authenticate($username, $password) {
// authenticate user
...
}
authenticate($_POST['password'], $_POST['username']);
Observed Examples
Reference Description
CVE-2006-7049 Application calls functions with arguments in the wrong order, allowing attacker
to bypass intended access restrictions.
https://www.cve.org/CVERecord?id=CVE-2006-7049
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
CWE-684: Incorrect Provision of Specified Functionality
Weakness ID : 684
Structure : Simple
Abstraction : Class
Description
The code does not function according to its published specifications, potentially leading to incorrect
usage.
Extended Description
When providing functionality to an external party, it is important that the product behaves in
accordance with the details specified. When requirements of nuances are not documented, the
functionality may produce unintended behaviors for the caller, possibly leading to an exploitable
state.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 710 Improper Adherence to Coding Standards 1549
CWE Version 4.14
CWE-684: Incorrect Provision of Specified Functionality
CWE-684: Incorrect Provision of Specified Functionality