692
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
ParentOf 842 Placement of User into Incorrect Group 1775
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Observed Examples
Reference Description
CVE-2022-36109 Containerization product does not record a user's supplementary group ID,
allowing bypass of group restrictions.
https://www.cve.org/CVERecord?id=CVE-2022-36109
CVE-1999-1193 Operating system assigns user to privileged wheel group, allowing the user to
gain root privileges.
https://www.cve.org/CVERecord?id=CVE-1999-1193
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 944 SFP Secondary Cluster: Access Management 888 2393
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
The relationships between privileges, permissions, and actors (e.g. users and groups) need
further refinement within the Research view. One complication is that these concepts apply to
two different pillars, related to control of resources (CWE-664) and protection mechanism failures
(CWE-693).
Maintenance
This item needs more work. Possible sub-categories include: user in wrong group, and user
with insecure profile or "configuration". It also might be better expressed as a category than a
weakness.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER User management errors
CWE-287: Improper Authentication
Weakness ID : 287
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-287: Improper Authentication
CWE-287: Improper Authentication