667
Related Attack Patterns
CAPEC-ID Attack Pattern Name
25 Forced Deadlock
26 Leveraging Race Conditions
27 Leveraging Race Conditions via Symbolic Links
References
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-668: Exposure of Resource to Wrong Sphere
Weakness ID : 668
Structure : Simple
Abstraction : Class
Description
The product exposes a resource to the wrong control sphere, providing unintended actors with
inappropriate access to the resource.
Extended Description
Resources such as files and directories may be inadvertently exposed through mechanisms
such as insecure permissions, or when a program accidentally operates on the wrong object. For
example, a program may intend that private files can only be provided to a specific user. This
effectively defines a control sphere that is intended to prevent attackers from accessing these
private files. If the file permissions are insecure, then parties other than the user will be able to
access those files.
CWE Version 4.14
CWE-668: Exposure of Resource to Wrong Sphere
CWE-668: Exposure of Resource to Wrong Sphere