665
Within the context of vulnerability theory, privileges and permissions are two sides of the same
coin. Privileges are associated with actors, and permissions are associated with resources. To
perform access control, at some point the product makes a decision about whether the actor
(and the privileges that have been assigned to that actor) is allowed to access the resource
(based on the permissions that have been specified for that resource).
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insufficient privileges
CWE-276: Incorrect Default Permissions
Weakness ID : 276
Structure : Simple
Abstraction : Base
Description
During installation, installed file permissions are set to allow anyone to modify those files.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 732 Incorrect Permission Assignment for Critical Resource 1551
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 732 Incorrect Permission Assignment for Critical Resource 1551
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 275 Permission Issues 2317
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
CWE Version 4.14
CWE-276: Incorrect Default Permissions
CWE-276: Incorrect Default Permissions