CWE-675 Multiple Operations on Resource in Single-Operation Context

The product performs the same operation on a resource two or more times, when the operation should only be applied once.

• Other: Varies by Context — The consequences will vary depending on how the operation works. This may depend on whether the responsibility for avoiding multiple operations is placed on the developer (which may be more risky), or whether there is built-in protection to prevent multiple invocations or handle them cleanly ("no action" or some kind of error report).

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2009-0935: Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice • CVE-2019-13351: file descriptor double close can cause the wrong file to be associated with a file descriptor. • CVE-2004-1939: XSS protection mechanism attempts to remove "/" that could be used to close tags, but it can be bypassed using double encoded slashes (%252F)