684
Related Attack Patterns
CAPEC-ID Attack Pattern Name
19 Embedding Scripts within Scripts
441 Malicious Logic Insertion
478 Modification of Windows Service Configuration
479 Malicious Root Certificate
502 Intent Spoof
503 WebView Exposure
536 Data Injected During Configuration
546 Incomplete Data Deletion in a Multi-Tenant Environment
550 Install New Service
551 Modify Existing Service
552 Install Rootkit
556 Replace File Extension Handlers
558 Replace Trusted Executable
562 Modify Shared File
563 Add Malicious File to Shared Webroot
564 Run Software at Logon
578 Disable Security Software
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-1287]MITRE. "Supplemental Details - 2022 CWE Top 25". 2022 June 8. < https://
cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails
>.
CWE-285: Improper Authorization
Weakness ID : 285
Structure : Simple
Abstraction : Class
Description
The product does not perform or incorrectly performs an authorization check when an actor
attempts to access a resource or perform an action.
Extended Description
Assuming a user with a given identity, authorization is the process of determining whether that user
can access a given resource, based on the user's privileges and any permissions or other accesscontrol
specifications that apply to the resource.
When access control checks are not applied consistently - or not at all - users are able to access
data or perform actions that they should not be allowed to perform. This can lead to a wide range of
problems, including information exposures, denial of service, and arbitrary code execution.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
CWE Version 4.14
CWE-285: Improper Authorization
CWE-285: Improper Authorization