CWEweakness

CWE-372 Incomplete Internal State Distinction

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

Common consequences

• Integrity, Other: Varies by Context, Unexpected State

Related

Attack pattern · CAPEC (2)

  • CAPEC-140 Bypassing of Intermediate Forms in Multiple-Form Sets attack pattern
  • CAPEC-74 Manipulating State attack pattern

Child of · CWE (1)

  • CWE-664 Improper Control of a Resource Through its Lifetime weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-140 Bypassing of Intermediate Forms in Multiple-Form Sets attack pattern
  • CAPEC-74 Manipulating State attack pattern

Referenced by CVE · weakness (12)

  • CVE-2026-119140 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic… vulnerability
  • CVE-2023-54406 Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False… vulnerability
  • CVE-2026-84897 src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diffie-Hellman group exchange messages SSH_MSG_KEX_DH_GEX_GROUP… vulnerability
  • CVE-2026-41388 OpenClaw before 2026.3.31 contains a configuration management vulnerability where startup migration treats empty-array settings as missing… vulnerability
  • CVE-2026-41340 OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorrectly fans… vulnerability
  • CVE-2026-41300 OpenClaw before 2026.3.31 contains a trust-decline vulnerability that preserves attacker-discovered endpoints in remote onboarding flows. vulnerability
  • CVE-2024-22590 The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. vulnerability
  • CVE-2023-4012 ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3). vulnerability
  • CVE-2023-36834 An Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and… vulnerability
  • CVE-2023-31127 libspdm is a sample implementation that follows the DMTF SPDM specifications. vulnerability
  • CVE-2021-25735 A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. vulnerability
  • CVE-2020-27222 In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS… vulnerability