1776
Nature Type ID Name Page
MemberOf 1212 Authorization Errors 2476
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Observed Examples
Reference Description
CVE-1999-1193 Operating system assigns user to privileged wheel group, allowing the user to
gain root privileges.
https://www.cve.org/CVERecord?id=CVE-1999-1193
CVE-2010-3716 Chain: drafted web request allows the creation of users with arbitrary group
membership.
https://www.cve.org/CVERecord?id=CVE-2010-3716
CVE-2008-5397 Chain: improper processing of configuration options causes users to contain
unintended group memberships.
https://www.cve.org/CVERecord?id=CVE-2008-5397
CVE-2007-6644 CMS does not prevent remote administrators from promoting other users to the
administrator group, in violation of the intended security model.
https://www.cve.org/CVERecord?id=CVE-2007-6644
CVE-2007-3260 Product assigns members to the root group, allowing escalation of privileges.
https://www.cve.org/CVERecord?id=CVE-2007-3260
CVE-2002-0080 Chain: daemon does not properly clear groups before dropping privileges.
https://www.cve.org/CVERecord?id=CVE-2002-0080
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Weakness ID : 843
Structure : Simple
Abstraction : Base
Description
The product allocates or initializes a resource such as a pointer, object, or variable using one type,
but it later accesses that resource using a type that is incompatible with the original type.
Extended Description
When the product accesses the resource using an incompatible type, this could trigger logical
errors because the resource does not have expected properties. In languages without memory
safety, such as C and C++, type confusion can lead to out-of-bounds memory access.
CWE Version 4.14
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')