674
Reference Description
CVE-2004-0148 FTP server places a user in the root directory when the user's permissions
prevent access to the their own home directory.
https://www.cve.org/CVERecord?id=CVE-2004-0148
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
CWE-280 and CWE-274 are too similar. It is likely that CWE-274 will be deprecated in the future.
Relationship
This can be both primary and resultant. When primary, it can expose a variety of weaknesses
because a resource might not have the expected state, and subsequent operations might fail. It
is often resultant from Unchecked Error Condition (CWE-391).
Theoretical
Within the context of vulnerability theory, privileges and permissions are two sides of the same
coin. Privileges are associated with actors, and permissions are associated with resources. To
perform access control, at some point the software makes a decision about whether the actor
(and the privileges that have been assigned to that actor) is allowed to access the resource
(based on the permissions that have been specified for that resource).
Research Gap
This type of issue is under-studied, since researchers often concentrate on whether an object
has too many permissions, instead of not enough. These weaknesses are likely to appear
in environments with fine-grained models for permissions and privileges, which can include
operating systems and other large-scale software packages. However, even highly simplistic
permission/privilege models are likely to contain these issues if the developer has not considered
the possibility of access failure.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Fails poorly due to insufficient
permissions
WASC 17 Improper Filesystem Permissions
Software Fault Patterns SFP4 Unchecked Status Condition
CWE-281: Improper Preservation of Permissions
Weakness ID : 281
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-281: Improper Preservation of Permissions
CWE-281: Improper Preservation of Permissions