647
Description
The product does not properly assign, modify, track, or check privileges for an actor, creating an
unintended sphere of control for that actor.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
ParentOf 250 Execution with Unnecessary Privileges 599
ParentOf 266 Incorrect Privilege Assignment 638
ParentOf 267 Privilege Defined With Unsafe Actions 641
ParentOf 268 Privilege Chaining 644
ParentOf 270 Privilege Context Switching Error 651
ParentOf 271 Privilege Dropping / Lowering Errors 653
ParentOf 274 Improper Handling of Insufficient Privileges 663
ParentOf 648 Incorrect Use of Privileged APIs 1428
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
CWE Version 4.14
CWE-269: Improper Privilege Management
CWE-269: Improper Privilege Management