669
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 275 Permission Issues 2317
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed Examples
Reference Description
CVE-2005-1841 User's umask is used when creating temp files.
https://www.cve.org/CVERecord?id=CVE-2005-1841
CVE-2002-1786 Insecure umask for core dumps [is the umask preserved or assigned?].
https://www.cve.org/CVERecord?id=CVE-2002-1786
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 946 SFP Secondary Cluster: Insecure Resource
Permissions
888 2394
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insecure inherited permissions
CWE-278: Insecure Preserved Inherited Permissions
Weakness ID : 278
CWE Version 4.14
CWE-278: Insecure Preserved Inherited Permissions
CWE-278: Insecure Preserved Inherited Permissions