605
CWE-271, CWE-272, and CWE-250 are all closely related and possibly overlapping. CWE-271
is probably better suited as a category. Both CWE-272 and CWE-250 are in active use by the
community. The "least privilege" phrase has multiple interpretations.
Maintenance
The Taxonomy_Mappings to ISA/IEC 62443 were added in CWE 4.10, but they are still under
review and might change in future CWE versions. These draft mappings were performed by
members of the "Mapping CWE to 62443" subgroup of the CWE-CAPEC ICS/OT Special Interest
Group (SIG), and their work is incomplete as of CWE 4.10. The mappings are included to
facilitate discussion and review by the broader ICS/OT community, and they are likely to change
in future CWE versions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Often Misused: Privilege Management
The CERT Oracle Secure
Coding Standard for Java
(2011)
SER09-J Minimize privileges before deserializing
from a privilege context
ISA/IEC 62443 Part 2-4 Req SP.03.05 BR
ISA/IEC 62443 Part 2-4 Req SP.03.08 BR
ISA/IEC 62443 Part 2-4 Req SP.03.08 RE(1)
ISA/IEC 62443 Part 2-4 Req SP.05.07 BR
ISA/IEC 62443 Part 2-4 Req SP.09.02 RE(4)
ISA/IEC 62443 Part 2-4 Req SP.09.03 BR
ISA/IEC 62443 Part 2-4 Req SP.09.04 BR
ISA/IEC 62443 Part 3-3 Req SR 1.1
ISA/IEC 62443 Part 3-3 Req SR 1.2
ISA/IEC 62443 Part 3-3 Req SR 2.1
ISA/IEC 62443 Part 3-3 Req SR 2.1 RE 1
ISA/IEC 62443 Part 4-1 Req SD-4
ISA/IEC 62443 Part 4-2 Req CCSC 3
ISA/IEC 62443 Part 4-2 Req CR 1.1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
69 Target Programs with Elevated Privileges
104 Cross Zone Scripting
470 Expanding Control over the Operating System from the Database
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE Version 4.14
CWE-252: Unchecked Return Value
CWE-252: Unchecked Return Value