641
Nature Type ID Name Page
MemberOf 1149 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 15. Platform Security (SEC)
1133 2452
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Incorrect Privilege Assignment
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC00-J Do not allow privileged blocks to leak
sensitive information across a trust
boundary
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC01-J Do not allow tainted variables in
privileged blocks
References
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
CWE-267: Privilege Defined With Unsafe Actions
Weakness ID : 267
Structure : Simple
Abstraction : Base
Description
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not
intended, even when it is assigned to the correct entity.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 269 Improper Privilege Management 646
ParentOf 623 Unsafe ActiveX Control Marked Safe For Scripting 1389
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
CWE Version 4.14
CWE-267: Privilege Defined With Unsafe Actions
CWE-267: Privilege Defined With Unsafe Actions