1222
Maintenance
As of CWE 4.9, members of the CWE Hardware SIG are working to improve CWE's coverage of
transient execution weaknesses, which include issues related to Spectre, Meltdown, and other
attacks that create or exploit covert channels. As a result of that work, this entry might change in
CWE 4.10.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Landwehr Storage
CLASP Covert storage channel
CWE-520: .NET Misconfiguration: Use of Impersonation
Weakness ID : 520
Structure : Simple
Abstraction : Variant
Description
Allowing a .NET application to run at potentially escalated levels of access to the underlying
operating and file systems can be dangerous and result in various forms of attacks.
Extended Description
.NET server applications can optionally execute using the identity of the user authenticated to
the client. The intention of this functionality is to bypass authentication and access control checks
within the .NET application code. Authentication is done by the underlying web server (Microsoft
Internet Information Service IIS), which passes the authenticated token, or unauthenticated
anonymous token, to the .NET application. Using the token to impersonate the client, the
application then relies on the settings within the NTFS directories and files to control access.
Impersonation enables the application, on the server running the .NET application, to both execute
code and access resources in the context of the authenticated and authorized user.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 266 Incorrect Privilege Assignment 638
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Potential Mitigations
Phase: Operation
Run the application with limited privilege to the underlying operating and file system.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-521: Weak Password Requirements
CWE-521: Weak Password Requirements