CWE-684: Incorrect Provision of Specified Functionality
The code does not function according to its published specifications, potentially leading to incorrect usage.
View on MITREExtended Description
When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.
Technical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
Phase
Description
Ensure that your code strictly conforms to specifications.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Demonstrative Examples
In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs.
In the following example, an HTTP 404 status code is returned in the event of an IOException encountered in a Java servlet. A 404 code is typically meant to indicate a non-existent resource and would be somewhat misleading in this case.
Observed CVE Examples (3)
Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.
View DetailsChain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).
View DetailsProgram uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
View DetailsCWE Relationships
No relationship information available for this CWE.
Frequently Asked Questions
What is CWE-684: Incorrect Provision of Specified Functionality?+
CWE-684: Incorrect Provision of Specified Functionality is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The code does not function according to its published specifications, potentially leading to incorrect usage. When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.
What are the security consequences of Incorrect Provision of Specified Functionality?+
If exploited, CWE-684 (Incorrect Provision of Specified Functionality) it can compromise Other, leading to outcomes such as Quality Degradation.
How do you prevent or mitigate Incorrect Provision of Specified Functionality?+
Recommended mitigations for CWE-684 include: Ensure that your code strictly conforms to specifications.
What are real-world examples of Incorrect Provision of Specified Functionality?+
MITRE documents real CVEs mapped to CWE-684, including CVE-2002-1446, CVE-2001-1559 and CVE-2003-0187. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-684 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.