656
Reference Description
https://www.cve.org/CVERecord?id=CVE-2000-0172
CVE-2004-2504 Windows program running as SYSTEM does not drop privileges before
executing other programs (many others like this, especially involving the Help
facility).
https://www.cve.org/CVERecord?id=CVE-2004-2504
CVE-2004-0213 Utility Manager launches winhlp32.exe while running with raised privileges,
which allows local users to gain system privileges.
https://www.cve.org/CVERecord?id=CVE-2004-0213
CVE-2004-0806 Setuid program does not drop privileges before executing program specified in
an environment variable.
https://www.cve.org/CVERecord?id=CVE-2004-0806
CVE-2004-0828 Setuid program does not drop privileges before processing file specified on
command line.
https://www.cve.org/CVERecord?id=CVE-2004-0828
CVE-2004-2070 Service on Windows does not drop privileges before using "view file" option,
allowing code execution.
https://www.cve.org/CVERecord?id=CVE-2004-2070
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
CWE-271, CWE-272, and CWE-250 are all closely related and possibly overlapping. CWE-271 is
probably better suited as a category.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Privilege Dropping / Lowering Errors
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-272: Least Privilege Violation
Weakness ID : 272
Structure : Simple
Abstraction : Base
Description
The elevated privilege level required to perform operations such as chroot() should be dropped
immediately after the operation is performed.
Relationships
CWE Version 4.14
CWE-272: Least Privilege Violation
CWE-272: Least Privilege Violation