639
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 265 Privilege Issues 2316
Weakness Ordinalities
Resultant :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive
information that may include administrative functionality
and user accounts.
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Phase: Operation
Strategy = Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks
[REF-76]. If possible, create isolated accounts with limited privileges that are only used for a
single task. That way, a successful attack will not immediately give the attacker access to the
rest of the software or its environment. For example, database applications rarely need to run as
the database administrator, especially in day-to-day operations.
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: C (Bad)
seteuid(0);
/* do some stuff */
seteuid(getuid());
Example 2:
The following example demonstrates the weakness.
Example Language: Java (Bad)
AccessController.doPrivileged(new PrivilegedAction() {
public Object run() {
// privileged code goes here, for example:
System.loadLibrary("awt");
return null;
// nothing to return
CWE Version 4.14
CWE-266: Incorrect Privilege Assignment
CWE-266: Incorrect Privilege Assignment