Détail du CWE-668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Modes d'introduction

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Conséquences courantes

Notes de cartographie des vulnérabilités

Justification : CWE-668 is high-level and is often misused as a catch-all when lower-level children might be applicable. It is sometimes used for low-information vulnerability reports [REF-1287]. It is a level-1 Class (i.e., a child of a Pillar). It is not useful for trend analysis.
Commentaire : Frequent misuse appears to be related to access control issues (poor authorization (CWE-285) or authentication (CWE-287)); insertion of sensitive information (CWE-201) or improper removal of sensitive information (CWE-212); or others. Closely analyze the specific mistake that is allowing the resource to be exposed, and perform a CWE mapping for that mistake. It is highly likely that CWE-668's children or descendants could apply.

Notes

A "control sphere" is a set of resources and behaviors that are accessible to a single actor, or a group of actors. A product's security model will typically define multiple spheres, possibly implicitly. For example, a server might define one sphere for "administrators" who can create new user accounts with subdirectories under /home/server/, and a second sphere might cover the set of users who can create or delete files within their own subdirectories. A third sphere might be "users who are authenticated to the operating system on which the product is installed." Each sphere has different sets of actors and allowable behaviors.

Références

REF-1287

Supplemental Details - 2022 CWE Top 25
MITRE.
https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails

Soumission

Modifications