1405
Description
The product does not perform access checks on a resource every time the resource is accessed
by an entity, which can create resultant weaknesses if that entity's rights or privileges change over
time.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 862 Missing Authorization 1780
ChildOf 657 Violation of Secure Design Principles 1446
ParentOf 424 Improper Protection of Alternate Path 1023
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Access Control
Other
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
Bypass Protection Mechanism
Read Application Data
Other
A user might retain access to a critical resource even after
privileges have been revoked, possibly allowing access to
privileged functionality or sensitive information, depending
on the role of the resource.
Potential Mitigations
Phase: Architecture and Design
Invalidate cached privileges, file handles or descriptors, or other access credentials whenever
identities, processes, policies, roles, capabilities or permissions change. Perform complete
authentication checks before accepting, caching and reusing data, dynamic content and code
(scripts). Avoid caching access control decisions as much as possible.
Phase: Architecture and Design
Identify all possible code paths that might access sensitive resources. If possible, create and use
a single interface that performs the access checks, and develop code standards that require use
of this interface.
Demonstrative Examples
Example 1:
When executable library files are used on web servers, which is common in PHP applications,
the developer might perform an access check in any user-facing executable, and omit the access
check from the library file itself. By directly requesting the library file (CWE-425), an attacker can
bypass this access check.
Example 2:
CWE Version 4.14
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-639: Authorization Bypass Through User-Controlled Key