2318
Summary
Weaknesses in this category are related to improper assignment or handling of permissions.
Membership
Nature Type ID Name Page
MemberOf 699 Software Development 699 2555
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
HasMember 276 Incorrect Default Permissions 699 665
HasMember 277 Insecure Inherited Permissions 699 668
HasMember 278 Insecure Preserved Inherited Permissions 699 669
HasMember 279 Incorrect Execution-Assigned Permissions 699 671
HasMember 280 Improper Handling of Insufficient Permissions or
Privileges
699 672
HasMember 281 Improper Preservation of Permissions 699 674
HasMember 618 Exposed Unsafe ActiveX Method 699 1380
HasMember 766 Critical Data Element Declared Public 699 1607
HasMember 767 Access to Critical Private Variable via Public Method 699 1610
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Permission errors
OWASP Top Ten 2004 A2 CWE More Specific Broken Access Control
OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
Notes
Terminology
Permissions are associated with a resource and specify which actors are allowed to access that
resource and what they are allowed to do with that access (e.g., read it, modify it). Privileges are
associated with an actor and define which behaviors or actions an actor is allowed to perform.
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
Category-310: Cryptographic Issues
Category ID : 310
Summary
Weaknesses in this category are related to the design and implementation of data confidentiality
and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and
hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data
if they are not addressed.
Membership
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
CWE Version 4.14
CWE-320: Key Management Errors
CWE-320: Key Management Errors