668
Nature Type ID Name Page
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1376 ICS Engineering (Construction/Deployment): Security
Gaps in Commissioning
1358 2512
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insecure Default Permissions
CERT C Secure Coding FIO06-C Create files with appropriate access
permissions
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO01-J Create files with appropriate access
permission
ISA/IEC 62443 Part 2-4 Req SP.03.08
ISA/IEC 62443 Part 4-2 Req CR 2.1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
81 Web Server Logs Tampering
127 Directory Indexing
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-277: Insecure Inherited Permissions
Weakness ID : 277
Structure : Simple
Abstraction : Variant
Description
A product defines a set of insecure permissions that are inherited by objects that are created by the
program.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 732 Incorrect Permission Assignment for Critical Resource 1551
Relevant to the view "Architectural Concepts" (CWE-1008)
CWE Version 4.14
CWE-278: Insecure Preserved Inherited Permissions
CWE-278: Insecure Preserved Inherited Permissions