1283
ParentOf 829 Inclusion of Functionality from Untrusted Control Sphere 1741
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Background Details
A "control sphere" is a set of resources and behaviors that are accessible to a single actor, or a
group of actors. A product's security model will typically define multiple spheres, possibly implicitly.
For example, a server might define one sphere for "administrators" who can create new user
accounts with subdirectories under /home/server/, and a second sphere might cover the set of
users who can create or delete files within their own subdirectories. A third sphere might be "users
who are authenticated to the operating system on which the product is installed." Each sphere has
different sets of actors and allowable behaviors.
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Unexpected State
CWE Version 4.14
CWE-669: Incorrect Resource Transfer Between Spheres
CWE-669: Incorrect Resource Transfer Between Spheres