The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
View on MITREIn various applications, a user is only expected to perform a certain action once, such as voting, requesting a refund, or making a purchase. When this restriction is not enforced, sometimes this can have security implications. For example, in a voting application, an attacker could attempt to "stuff the ballot box" by voting multiple times. If these votes are counted separately, then the attacker could directly affect who wins the vote. This could have significant business impact depending on the purpose of the product.
An attacker might be able to gain advantage over other users by performing the action multiple times, or affect the correctness of the product.
No mitigation information available for this CWE.
No detection method information available for this CWE.
Ticket-booking web application allows a user to lock a seat more than once.
View DetailsChain: lack of validation of a challenge key in a game allows a player to register multiple times and lock other players out of the game.
View DetailsLibrary feature allows attackers to check out the same e-book multiple times, preventing other users from accessing copies of the e-book.
View DetailsProtocol implementation allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many message exchanges.
View DetailsCWE-837: Improper Enforcement of a Single, Unique Action is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction. In various applications, a user is only expected to perform a certain action once, such as voting, requesting a refund, or making a purchase. When this restriction is not enforced, sometimes this can have security implications. For example, in a voting application, an attacker could attempt to "stuff the ballot box" by voting multiple times. If these votes are counted separately, then the attacker could directly affect who wins the vote. This could have significant business impact depending on the purpose of the product.
If exploited, CWE-837 (Improper Enforcement of a Single, Unique Action) it can compromise Other, leading to outcomes such as Varies by Context.
CWE-837 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-837, including CVE-2008-0294, CVE-2005-4051, CVE-2002-216, CVE-2003-1433 and CVE-2002-1018. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-837 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.