638
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-1305]Kurt Seifried and other members of the CWE-Research mailing list. "Discussion Thread:
Time to retire CWE-262 and CWE-263". 2021 December 3. < https://www.mail-archive.com/cweresearch-
list@mitre.org/msg00018.html >.2022-10-11.
[REF-1289]Lance Spitzner. "Time for Password Expiration to Die". 2021 June 7. < https://
www.sans.org/blog/time-for-password-expiration-to-die/ >.
[REF-1290]Lorrie Cranor. "Time to rethink mandatory password changes". 2016 March 2. < https://
www.ftc.gov/policy/advocacy-research/tech-at-ftc/2016/03/time-rethink-mandatory-passwordchanges
>.
[REF-1291]Eugene Spafford. "Security Myths and Passwords". 2006 April 9. < https://
www.cerias.purdue.edu/site/blog/post/password-change-myths/ >.
[REF-1292]National Cyber Security Centre. "Password administration for system owners". 2018
November 9. < https://www.ncsc.gov.uk/collection/passwords >.2023-04-07.
[REF-1293]NIST. "Digital Identity Guidelines: Authentication and Lifecycle Management(SP
800-63B)". 2017 June. < https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-63b.pdf >.2023-04-07.
[REF-1294]National Cyber Security Centre. "Let them paste passwords". 2017 January 2. < https://
www.ncsc.gov.uk/blog-post/let-them-paste-passwords >.2023-04-07.
CWE-266: Incorrect Privilege Assignment
Weakness ID : 266
Structure : Simple
Abstraction : Base
Description
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of
control for that actor.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 269 Improper Privilege Management 646
ParentOf 9 J2EE Misconfiguration: Weak Access Permissions for EJB
Methods