1552
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ParentOf 276 Incorrect Default Permissions 665
ParentOf 281 Improper Preservation of Permissions 674
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : Cloud Computing (Prevalence = Often)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Read Files or Directories
An attacker may be able to read sensitive information
from the associated resource, such as credentials or
configuration information stored in a file.
Access Control Gain Privileges or Assume Identity
An attacker may be able to modify critical properties of the
associated resource to gain privileges, such as replacing a
world-writable executable with a Trojan horse.
Integrity
Other
Modify Application Data
Other
An attacker may be able to destroy or corrupt critical data
in the associated resource, such as deletion of records
from a database.
Detection Methods
Automated Static Analysis
Automated static analysis may be effective in detecting permission problems for system
resources such as files, directories, shared memory, device interfaces, etc. Automated
techniques may be able to detect the use of library functions that modify permissions, then
analyze function calls for arguments that contain potentially insecure values. However, since the
software's intended security policy might allow loose permissions for certain operations (such as
publishing a file on a web server), automated static analysis may produce some false positives -
i.e., warnings that do not have any security consequences or require any code changes. When
custom permissions models are used - such as defining who can read messages in a particular
forum in a bulletin board system - these can be difficult to detect using automated static analysis.
It may be possible to define custom signatures that identify any custom functions that implement
the permission checks and assignments.
Automated Dynamic Analysis
Automated dynamic analysis may be effective in detecting permission problems for system
resources such as files, directories, shared memory, device interfaces, etc. However, since
the software's intended security policy might allow loose permissions for certain operations
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource