1551
Phase: Testing
Phase: Implementation
Where possible, use automated tools to enforce the standards.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 978 SFP Secondary Cluster: Implementation 888 2408
MemberOf 1370 ICS Supply Chain: Common Mode Frailties 1358 2507
MemberOf 1375 ICS Engineering (Construction/Deployment): Gaps in
Details/Data
1358 2511
MemberOf 1383 ICS Operations (& Maintenance): Compliance/
Conformance with Regulatory Requirements
1358 2517
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
CWE-732: Incorrect Permission Assignment for Critical Resource
Weakness ID : 732
Structure : Simple
Abstraction : Class
Description
The product specifies permissions for a security-critical resource in a way that allows that resource
to be read or modified by unintended actors.
Extended Description
When a resource is given a permission setting that provides access to a wider range of actors than
required, it could lead to the exposure of sensitive information, or the modification of that resource
by unintended parties. This is especially dangerous when the resource is related to program
configuration, execution, or sensitive user data. For example, consider a misconfigured storage
account for the cloud that can be read or written by a public or anonymous user.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
ChildOf 285 Improper Authorization 684
ParentOf 276 Incorrect Default Permissions 665
ParentOf 277 Insecure Inherited Permissions 668
ParentOf 278 Insecure Preserved Inherited Permissions 669
ParentOf 279 Incorrect Execution-Assigned Permissions 671
ParentOf 281 Improper Preservation of Permissions 674
ParentOf 766 Critical Data Element Declared Public 1607
ParentOf 1004 Sensitive Cookie Without 'HttpOnly' Flag 1854
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource