1471
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ParentOf 134 Use of Externally-Controlled Format String 365
ParentOf 426 Untrusted Search Path 1028
ParentOf 427 Uncontrolled Search Path Element 1033
ParentOf 428 Unquoted Search Path or Element 1039
ParentOf 552 Files or Directories Accessible to External Parties 1265
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Other
Read Application Data
Modify Application Data
Other
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Notes
Theoretical
A "control sphere" is a set of resources and behaviors that are accessible to a single actor,
or a group of actors. A product's security model will typically define multiple spheres, possibly
implicitly. For example, a server might define one sphere for "administrators" who can create new
user accounts with subdirectories under /home/server/, and a second sphere might cover the set
of users who can create or delete files within their own subdirectories. A third sphere might be
"users who are authenticated to the operating system on which the product is installed." Each
sphere has different sets of actors and allowable behaviors.
References
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
CWE-669: Incorrect Resource Transfer Between Spheres
Weakness ID : 669
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-669: Incorrect Resource Transfer Between Spheres
CWE-669: Incorrect Resource Transfer Between Spheres