1548
CAPEC-ID Attack Pattern Name
250 XML Injection
276 Inter-component Protocol Manipulation
277 Data Interchange Protocol Manipulation
278 Web Services Protocol Manipulation
279 SOAP Manipulation
468 Generic Cross-Browser Cross-Domain Theft
CWE-708: Incorrect Ownership Assignment
Weakness ID : 708
Structure : Simple
Abstraction : Base
Description
The product assigns an owner to a resource, but the owner is outside of the intended control
sphere.
Extended Description
This may allow the resource to be manipulated by actors outside of the intended control sphere.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 282 Improper Ownership Management 676
CanAlsoBe 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 840 Business Logic Errors 2360
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
An attacker could read and modify data for which they do
not have permissions to access directly.
Potential Mitigations
Phase: Policy
Periodically review the privileges and their owners.
CWE Version 4.14
CWE-710: Improper Adherence to Coding Standards
CWE-710: Improper Adherence to Coding Standards