691
CAPEC-ID Attack Pattern Name
77 Manipulating User-Controlled Variables
87 Forceful Browsing
104 Cross Zone Scripting
127 Directory Indexing
402 Bypassing ATA Password Security
647 Collect Data from Registries
668 Key Negotiation of Bluetooth Attack (KNOB)
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-229]NIST. "Role Based Access Control and Role Based Security". < https://csrc.nist.gov/
projects/role-based-access-control >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-231]Frank Kim. "Top 25 Series - Rank 5 - Improper Access Control (Authorization)". 2010
March 4. SANS Software Security Institute. < https://www.sans.org/blog/top-25-series-rank-5-
improper-access-control-authorization/ >.2023-04-07.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-233]Rahul Bhattacharjee. "Authentication using JAAS". < https://javaranch.com/
journal/2008/04/authentication-using-JAAS.html >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-286: Incorrect User Management
Weakness ID : 286
Structure : Simple
Abstraction : Class
Description
The product does not properly manage a user within its environment.
Extended Description
Users can be assigned to the wrong group (class) of permissions resulting in unintended access
rights to sensitive objects.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-287: Improper Authentication
CWE-287: Improper Authentication