Privilege Issues
A category in the Common Weakness Enumeration published by The MITRE Corporation.
Summary
Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.
Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
Weaknesses
The product contains a clone() method that does not call super.clone() to obtain the new object.
The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the j...
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of ot...
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may...
The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the f...
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that...
The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
The product mixes trusted and untrusted data in the same data structure or structured message.
Concepts
This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development l...
Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.