690
Reference Description
CVE-2005-2801 Chain: file-system code performs an incorrect comparison (CWE-697),
preventing default ACLs from being properly applied.
https://www.cve.org/CVERecord?id=CVE-2005-2801
CVE-2001-1155 Chain: product does not properly check the result of a reverse DNS lookup
because of operator precedence (CWE-783), allowing bypass of DNS-based
access restrictions.
https://www.cve.org/CVERecord?id=CVE-2001-1155
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 721 OWASP Top Ten 2007 Category A10 - Failure to
Restrict URL Access
629 2333
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 753 2009 Top 25 - Porous Defenses 750 2353
MemberOf 803 2010 Top 25 - Porous Defenses 800 2355
MemberOf 817 OWASP Top Ten 2010 Category A8 - Failure to Restrict
URL Access
809 2359
MemberOf 935 OWASP Top Ten 2013 Category A7 - Missing Function
Level Access Control
928 2392
MemberOf 945 SFP Secondary Cluster: Insecure Resource Access 888 2394
MemberOf 1031 OWASP Top Ten 2017 Category A5 - Broken Access
Control
1026 2437
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1382 ICS Operations (& Maintenance): Emerging Energy
Technologies
1358 2517
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Missing Access Control
OWASP Top Ten 2007 A10 CWE More Specific Failure to Restrict URL Access
OWASP Top Ten 2004 A2 CWE More Specific Broken Access Control
Software Fault Patterns SFP35 Insecure resource access
Related Attack Patterns
CAPEC-ID Attack Pattern Name
1 Accessing Functionality Not Properly Constrained by ACLs
5 Blue Boxing
13 Subverting Environment Variable Values
17 Using Malicious Files
39 Manipulating Opaque Client-based Data Tokens
45 Buffer Overflow via Symbolic Links
51 Poison Web Service Registry
59 Session Credential Falsification through Prediction
60 Reusing Session IDs (aka Session Replay)
76 Manipulating Web Input to File System Calls
CWE Version 4.14
CWE-286: Incorrect User Management
CWE-286: Incorrect User Management