Incomplete Internal State Distinction
CWE-372
The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9.
Latest Incomplete Internal State Distinction vulnerabilities
- 9.1 Critical severity
kwik: Incomplete Internal State Distinction
The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection. This vulnerability can allow Client Hello messages to be overwritten at any time, including after a connection has been established.
- 8.8 High severity
libspdm: Improper Authentication
libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishment in libspdm prior to version 2.3.1. If a device supports both DHE session and PSK session with mutual authentication,