1786
Reference Description
CVE-2001-1155 Chain: product does not properly check the result of a reverse DNS lookup
because of operator precedence (CWE-783), allowing bypass of DNS-based
access restrictions.
https://www.cve.org/CVERecord?id=CVE-2001-1155
CVE-2020-17533 Chain: unchecked return value (CWE-252) of some functions for policy
enforcement leads to authorization bypass (CWE-862)
https://www.cve.org/CVERecord?id=CVE-2020-17533
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 813 OWASP Top Ten 2010 Category A4 - Insecure Direct
Object References
809 2357
MemberOf 817 OWASP Top Ten 2010 Category A8 - Failure to Restrict
URL Access
809 2359
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous
Software Weaknesses
1337 2589
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 2-1 Req 4.3.3.7
ISA/IEC 62443 Part 3-3 Req SR 2.1
ISA/IEC 62443 Part 4-2 Req CR 2.1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
665 Exploitation of Thunderbolt Protection Flaws
References
[REF-229]NIST. "Role Based Access Control and Role Based Security". < https://csrc.nist.gov/
projects/role-based-access-control >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-231]Frank Kim. "Top 25 Series - Rank 5 - Improper Access Control (Authorization)". 2010
March 4. SANS Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-5-
improper-access-control-authorization/ >.2023-04-07.
CWE Version 4.14
CWE-863: Incorrect Authorization
CWE-863: Incorrect Authorization