664
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Other
Alter Execution Logic
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Observed Examples
Reference Description
CVE-2001-1564 System limits are not properly enforced after privileges are dropped.
https://www.cve.org/CVERecord?id=CVE-2001-1564
CVE-2005-3286 Firewall crashes when it can't read a critical memory block that was protected
by a malicious process.
https://www.cve.org/CVERecord?id=CVE-2005-3286
CVE-2005-1641 Does not give admin sufficient privileges to overcome otherwise legitimate user
actions.
https://www.cve.org/CVERecord?id=CVE-2005-1641
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
CWE-280 and CWE-274 are too similar. It is likely that CWE-274 will be deprecated in the future.
Relationship
Overlaps dropped privileges, insufficient permissions.
Theoretical
This has a layering relationship with Unchecked Error Condition and Unchecked Return Value.
Theoretical
CWE Version 4.14
CWE-276: Incorrect Default Permissions
CWE-276: Incorrect Default Permissions