CWE-799 Improper Control of Interaction Frequency
What this means
SiteShadow flagged missing or ineffective limits on how often an action can be attempted (login attempts, password reset requests, OTP verification, expensive searches). This is usually a rate limiting / throttling issue.
Why it matters
Missing controls can allow brute force or abuse.
- Credential stuffing / brute force against logins and OTPs.
- Resource exhaustion: repeated expensive requests degrade availability (see
CWE-400/CWE-419). - Abuse/fraud: scraping, enumeration, and automated actions.
Safer examples
1) Add rate limits at the edge and at the app
Rate-limit by user, IP, and API key where applicable; enforce server-side.
2) Add progressive delays and attempt caps
Lock out or require additional verification after repeated failures (see A07).
3) Make sensitive flows single-use and time-bound
Password reset/verify tokens should expire quickly and be single-use.
How SiteShadow detects it (high level)
- Detects sensitive endpoints lacking rate limiting/throttling primitives.
- Flags loops/retries that allow unlimited attempts on auth or high-cost operations.
References
- CWE-799: https://cwe.mitre.org/data/definitions/799.html
---