672
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed Examples
Reference Description
CVE-2002-0265 Log files opened read/write.
https://www.cve.org/CVERecord?id=CVE-2002-0265
CVE-2003-0876 Log files opened read/write.
https://www.cve.org/CVERecord?id=CVE-2003-0876
CVE-2002-1694 Log files opened read/write.
https://www.cve.org/CVERecord?id=CVE-2002-1694
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 946 SFP Secondary Cluster: Insecure Resource
Permissions
888 2394
MemberOf 1147 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 13. Input Output (FIO)
1133 2450
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insecure execution-assigned
permissions
CERT C Secure Coding FIO06-C Create files with appropriate access
permissions
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO01-J Create files with appropriate access
permission
Related Attack Patterns
CAPEC-ID Attack Pattern Name
81 Web Server Logs Tampering
CWE-280: Improper Handling of Insufficient Permissions or Privileges
Weakness ID : 280
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-280: Improper Handling of Insufficient Permissions or Privileges
CWE-280: Improper Handling of Insufficient Permissions or Privileges