653
Consider following the principle of separation of privilege. Require multiple conditions to be met
before permitting access to a system resource.
Observed Examples
Reference Description
CVE-2002-1688 Web browser cross domain problem when user hits "back" button.
https://www.cve.org/CVERecord?id=CVE-2002-1688
CVE-2003-1026 Web browser cross domain problem when user hits "back" button.
https://www.cve.org/CVERecord?id=CVE-2003-1026
CVE-2002-1770 Cross-domain issue - third party product passes code to web browser, which
executes it in unsafe zone.
https://www.cve.org/CVERecord?id=CVE-2002-1770
CVE-2005-2263 Run callback in different security context after it has been changed from
untrusted to trusted. * note that "context switch before actions are completed"
is one type of problem that happens frequently, espec. in browsers.
https://www.cve.org/CVERecord?id=CVE-2005-2263
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Research Gap
This concept needs more study.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Privilege Context Switching Error
Related Attack Patterns
CAPEC-ID Attack Pattern Name
17 Using Malicious Files
30 Hijacking a Privileged Thread of Execution
35 Leverage Executable Code in Non-Executable Files
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
CWE-271: Privilege Dropping / Lowering Errors
Weakness ID : 271
Structure : Simple
Abstraction : Class
CWE Version 4.14
CWE-271: Privilege Dropping / Lowering Errors
CWE-271: Privilege Dropping / Lowering Errors