The description above is MITRE’s definition of CWE-367 in CWE 4.20, a base-level weakness.
Common consequences MITRE lists
- Integrity, Other: Alter Execution Logic; Unexpected State
- Integrity, Other: Modify Application Data; Modify Files or Directories; Modify Memory; Other
- Integrity, Other: Other
- Non-Repudiation: Hide Activities
- Non-Repudiation, Other: Other
- Other: Unexpected State
Guides on this site
Preserve business invariants under concurrent requests
Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
Authorize agent tools outside the model
Bind each proposed action to the user, resource and approved arguments before allowing a tool to cause a side effect.
Threat pattern library for threat modeling
Thirty-two recurring threat patterns grouped by identity, authorization, parsers, concurrency, integrations, data exposure, supply chain, availability and AI agents, each with where it shows up on a data-flow diagram, mitigations, a verification step and STRIDE, CWE and CAPEC links, plus a YAML catalog and a script that lists patterns per diagram element.
Create temporary files safely: mkstemp, O_EXCL and private directories
Stop symlink, hardlink and pre-created-file attacks on the temporary files your code writes in shared directories such as /tmp: create each file atomically with O_EXCL and owner-only permissions through mkstemp or its equivalent in shell, Python, Java, Node.js, Go, .NET and Rust, keep related files in a private directory, and treat the Linux protected_* sysctls and systemd PrivateTmp as a backstop.
Practice
- Race condition lab: Repair a balance check that races · Browser lab
- Excessive agency lab: Bind an agent’s action to the approved arguments · Browser lab
- Business logic lab: Price an order without trusting the client · Browser lab
- Make a checkout transaction atomic · Local project
- Enforce retrieval and tool boundaries across crashes · Local project
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-367.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.