CWE-799 Improper Control of Interaction Frequency

Coverage: 6 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged missing or ineffective limits on how often an action can be attempted (login attempts, password reset requests, OTP verification, expensive searches). This is usually a rate limiting / throttling issue.

Why it matters

Missing controls can allow brute force or abuse.

• Credential stuffing / brute force against logins and OTPs.
• Resource exhaustion: repeated expensive requests degrade availability (see CWE-400 / CWE-419).
• Abuse/fraud: scraping, enumeration, and automated actions.

Safer examples

1) Add rate limits at the edge and at the app

Rate-limit by user, IP, and API key where applicable; enforce server-side.

2) Add progressive delays and attempt caps

Lock out or require additional verification after repeated failures (see A07).

3) Make sensitive flows single-use and time-bound

Password reset/verify tokens should expire quickly and be single-use.

How SiteShadow detects it (high level)

• Detects sensitive endpoints lacking rate limiting/throttling primitives.
• Flags loops/retries that allow unlimited attempts on auth or high-cost operations.

References

• CWE-799: https://cwe.mitre.org/data/definitions/799.html

---

← Back to Vulnerability Library