680
CWE-284: Improper Access Control
Weakness ID : 284
Structure : Simple
Abstraction : Pillar
Description
The product does not restrict or incorrectly restricts access to a resource from an unauthorized
actor.
Extended Description
Access control involves the use of several protection mechanisms such as:
• Authentication (proving the identity of an actor)
• Authorization (ensuring that a given actor can access a resource), and
• Accountability (tracking of activities that were performed)
When any mechanism is not applied or otherwise fails, attackers can compromise the security of
the product by gaining privileges, reading sensitive information, executing commands, evading
detection, etc.
There are two distinct behaviors that can introduce access control weaknesses:
• Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for
either the user or the resource (for example, setting a password file to be world-writable,
or giving administrator capabilities to a guest user). This action could be performed by the
program or the administrator.
• Enforcement: the mechanism contains errors that prevent it from properly enforcing the
specified access control requirements (e.g., allowing the user to specify their own privileges,
or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs
within the program itself, in that it does not actually enforce the intended security policy that
the administrator specifies.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
MemberOf 1000 Research Concepts 2575
ParentOf 269 Improper Privilege Management 646
ParentOf 282 Improper Ownership Management 676
ParentOf 285 Improper Authorization 684
ParentOf 286 Incorrect User Management 691
ParentOf 287 Improper Authentication 692
ParentOf 346 Origin Validation Error 853
ParentOf 749 Exposed Dangerous Method or Function 1564
ParentOf 923 Improper Restriction of Communication Channel to Intended
Endpoints