QwikSec

Security Database

CVE

CWE

Training

CWE Database
/

CWE-393

Back to CWE list

CWE-393

Return of Wrong Status Code

Base
Draft

Description

A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.

This can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe or correct, even when it is not.

Common Consequences

Scope

Integrity
Other

Impact

Unexpected State, Alter Execution Logic

CVE-2003-1132

DNS server returns wrong response code for non-existent AAAA record, which effectively says that the domain is inaccessible.

CVE-2001-1509

Hardware-specific implementation of system call causes incorrect results from geteuid.

CVE-2001-1559

Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).

CVE-2014-1266

Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Applicable Platforms

Not Language-Specific

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now