646
}
else{
System.out.println("You must be logged in to perform this command");
}
}
This code does not check the role of the user whose password is being reset. It is possible for
an Operator to gain Admin privileges by resetting the password of an Admin account and taking
control of that account.
Observed Examples
Reference Description
CVE-2005-1736 Chaining of user rights.
https://www.cve.org/CVERecord?id=CVE-2005-1736
CVE-2002-1772 Gain certain rights via privilege chaining in alternate channel.
https://www.cve.org/CVERecord?id=CVE-2002-1772
CVE-2005-1973 Application is allowed to assign extra permissions to itself.
https://www.cve.org/CVERecord?id=CVE-2005-1973
CVE-2003-0640 "operator" user can overwrite usernames and passwords to gain admin
privileges.
https://www.cve.org/CVERecord?id=CVE-2003-0640
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
There is some conceptual overlap with Unsafe Privilege.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Privilege Chaining
References
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
CWE-269: Improper Privilege Management
Weakness ID : 269
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-269: Improper Privilege Management
CWE-269: Improper Privilege Management