{"@ID": "840", "@Name": "Business Logic Errors", "@Status": "Incomplete", "Summary": "Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.", "Relationships": {"Has_Member": [{"@CWE_ID": "283", "@View_ID": "699"}, {"@CWE_ID": "639", "@View_ID": "699"}, {"@CWE_ID": "640", "@View_ID": "699"}, {"@CWE_ID": "708", "@View_ID": "699"}, {"@CWE_ID": "770", "@View_ID": "699"}, {"@CWE_ID": "826", "@View_ID": "699"}, {"@CWE_ID": "837", "@View_ID": "699"}, {"@CWE_ID": "841", "@View_ID": "699"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-795"}, {"@External_Reference_ID": "REF-796"}, {"@External_Reference_ID": "REF-797"}, {"@External_Reference_ID": "REF-798"}, {"@External_Reference_ID": "REF-799"}, {"@External_Reference_ID": "REF-667"}, {"@External_Reference_ID": "REF-801"}, {"@External_Reference_ID": "REF-802", "@Section": "pages 29 - 41"}, {"@External_Reference_ID": "REF-1102"}]}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "The \"Business Logic\" term generally reflects product-specific logic errors that can be characterized by various weaknesses related to issues such as access control, workflow, input validation, etc. Perform root cause analysis to determine what mistake led to the logic error.  Consult the member weaknesses of this category.", "Reasons": {"Reason": [{"@Type": "Grouping"}, {"@Type": "Frequent Misuse"}]}}, "Notes": {"Note": [{"@Type": "Terminology", "xhtml:p": "The \"Business Logic\" term is generally used to describe issues that require domain-specific knowledge or \"business rules\" to determine if they are weaknesses or vulnerabilities, instead of legitimate behavior. Such issues might not be easily detectable via automatic code analysis, because the associated operations do not produce clear errors or undefined behavior at the code level. However, many such \"business logic\" issues can be understood as instances of other weaknesses such as input validation, access control, numeric computation, order of operations, etc.", "#text_blocks": ["The \"Business Logic\" term is generally used to describe issues that require domain-specific knowledge or \"business rules\" to determine if they are weaknesses or vulnerabilities, instead of legitimate behavior. Such issues might not be easily detectable via automatic code analysis, because the associated operations do not produce clear errors or undefined behavior at the code level. However, many such \"business logic\" issues can be understood as instances of other weaknesses such as input validation, access control, numeric computation, order of operations, etc."]}, {"@Type": "Research Gap", "xhtml:p": ["The classification of business logic flaws has been under-studied, although exploitation of business flaws frequently happens in real-world systems, and many applied vulnerability researchers investigate them. The greatest focus is in web applications. There is debate within the community about whether these problems represent particularly new concepts, or if they are variations of well-known principles.", "Many business logic flaws appear to be oriented toward business processes, application flows, and sequences of behaviors, which are not as well-represented in CWE as weaknesses related to input validation, memory management, etc."], "#text_blocks": ["The classification of business logic flaws has been under-studied, although exploitation of business flaws frequently happens in real-world systems, and many applied vulnerability researchers investigate them. The greatest focus is in web applications. There is debate within the community about whether these problems represent particularly new concepts, or if they are variations of well-known principles.", "Many business logic flaws appear to be oriented toward business processes, application flows, and sequences of behaviors, which are not as well-represented in CWE as weaknesses related to input validation, memory management, etc."]}]}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2011-03-24", "Submission_Version": "1.12", "Submission_ReleaseDate": "2011-03-30"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-01-19", "Modification_Version": "2.10", "Modification_ReleaseDate": "2017-01-19", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Description, Observed_Examples, References, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Terminology_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}]}, "entry_type": "Grouping"}