1787
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-233]Rahul Bhattacharjee. "Authentication using JAAS". < https://javaranch.com/
journal/2008/04/authentication-using-JAAS.html >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-863: Incorrect Authorization
Weakness ID : 863
Structure : Simple
Abstraction : Class
Description
The product performs an authorization check when an actor attempts to access a resource or
perform an action, but it does not correctly perform the check. This allows attackers to bypass
intended access restrictions.
Extended Description
Assuming a user with a given identity, authorization is the process of determining whether that user
can access a given resource, based on the user's privileges and any permissions or other accesscontrol
specifications that apply to the resource.
When access control checks are incorrectly applied, users are able to access data or perform
actions that they should not be allowed to perform. This can lead to a wide range of problems,
including information exposures, denial of service, and arbitrary code execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 285 Improper Authorization 684
ParentOf 551 Incorrect Behavior Order: Authorization Before Parsing and
Canonicalization