651
Nature Type ID Name Page
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous
Software Weaknesses
1350 2594
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1373 ICS Engineering (Construction/Deployment): Trust
Model Problems
1358 2510
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
Notes
Maintenance
The relationships between privileges, permissions, and actors (e.g. users and groups) need
further refinement within the Research view. One complication is that these concepts apply to
two different pillars, related to control of resources (CWE-664) and protection mechanism failures
(CWE-693).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Privilege Management Error
ISA/IEC 62443 Part 2-4 Req SP.03.08 BR
ISA/IEC 62443 Part 3-2 Req CR 3.1
ISA/IEC 62443 Part 3-3 Req SR 1.2
ISA/IEC 62443 Part 3-3 Req SR 2.1
ISA/IEC 62443 Part 4-1 Req SD-3
ISA/IEC 62443 Part 4-1 Req SD-4
ISA/IEC 62443 Part 4-1 Req SI-1
ISA/IEC 62443 Part 4-2 Req CR 1.1
ISA/IEC 62443 Part 4-2 Req CR 2.1
Related Attack Patterns
CAPEC-ID Attack Pattern Name
58 Restful Privilege Elevation
122 Privilege Abuse
233 Privilege Escalation
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
CWE-270: Privilege Context Switching Error
Weakness ID : 270
CWE Version 4.14
CWE-270: Privilege Context Switching Error
CWE-270: Privilege Context Switching Error