888
Requires 340 Generation of Predictable Numbers or Identifiers 842
Requires 386 Symbolic Name not Mapping to Correct Object 942
Requires 732 Incorrect Permission Assignment for Critical Resource 1551
Extended Description
A product that allows UNIX symbolic links (symlink) as part of paths whether in internal code or
through user input can allow an attacker to spoof the symbolic link and traverse the file system to
unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/
write/corrupt a file that they originally did not have permissions to access.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 59 Improper Link Resolution Before File Access ('Link
Following')