CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities
An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
How it's found
Improper Interaction Between Multiple Correctly-Behaving Entities is a broad weakness category rather than one exact bug. Testers narrow it down through manual code review and architecture review to identify which of its more specific child weaknesses actually appears in a given target, then confirm each one individually.
When a system or process combines multiple independent components, this often produces new, emergent behaviors at the system level. However, if the interactions between these components are not fully accounted for, some of the emergent behaviors can be incorrect or even insecure.
Consequences
- Unexpected State, Varies by Context
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-435?
An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
How do you find Improper Interaction Between Multiple Correctly-Behaving Entities?
Improper Interaction Between Multiple Correctly-Behaving Entities is a broad weakness category rather than one exact bug. Testers narrow it down through manual code review and architecture review to identify which of its more specific child weaknesses actually appears in a given target, then confirm each one individually.
What is the impact of CWE-435?
Unexpected State, Varies by Context
Does TurboPentest test for Improper Interaction Between Multiple Correctly-Behaving Entities?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest