1272
Configuring an ASP.NET application to run with impersonated credentials may give the application
unnecessary privileges.
Extended Description
The use of impersonated credentials allows an ASP.NET application to run with either the
privileges of the client on whose behalf it is executing or with arbitrary privileges granted in its
configuration.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 266 Incorrect Privilege Assignment 638
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Potential Mitigations
Phase: Architecture and Design
Use the least privilege principle.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-558: Use of getlogin() in Multithreaded Application
Weakness ID : 558
Structure : Simple
Abstraction : Variant
Description
The product uses the getlogin() function in a multithreaded context, potentially causing it to return
incorrect values.
Extended Description
The getlogin() function returns a pointer to a string that contains the name of the user associated
with the calling process. The function is not reentrant, meaning that if it is called from another
process, the contents are not locked out and the value of the string can be changed by another
process. This makes it very risky to use because the username can be changed by other
processes, so the results of the function cannot be trusted.
CWE Version 4.14
CWE-558: Use of getlogin() in Multithreaded Application
CWE-558: Use of getlogin() in Multithreaded Application