670
Structure : Simple
Abstraction : Variant
Description
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive
file, without user awareness or involvement.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 732 Incorrect Permission Assignment for Critical Resource 1551
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 275 Permission Issues 2317
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed Examples
Reference Description
CVE-2005-1724 Does not obey specified permissions when exporting.
https://www.cve.org/CVERecord?id=CVE-2005-1724
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-279: Incorrect Execution-Assigned Permissions
CWE-279: Incorrect Execution-Assigned Permissions