2156
ParentOf 1328 Security Version Number Mutable to Older Versions 2217
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Server (Prevalence = Often)
Technology : Database Server (Prevalence = Often)
Background Details
An access control list (ACL) represents who/what has permissions to a given object. Different
operating systems implement (ACLs) in different ways. In UNIX, there are three types of
permissions: read, write, and execute. Users are divided into three classes for file access: owner,
group owner, and all other users where each class has a separate set of rights. In Windows NT,
there are four basic types of permissions for files: "No access", "Read access", "Change access",
and "Full control". Windows NT extends the concept of three types of users in UNIX to include a list
of users and groups along with their associated permissions. A user can create an object (file) and
assign specified permissions to that object.
Alternate Terms
AuthZ : "AuthZ" is typically used as an abbreviation of "authorization" within the web application
security community. It is distinct from "AuthN" (or, sometimes, "AuthC") which is an abbreviation
of "authentication." The use of "Auth" as an abbreviation is discouraged, since it could be used for
either authentication or authorization.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
CWE Version 4.14
CWE-285: Improper Authorization
CWE-285: Improper Authorization