Detail Kategori CWE-1011

CWE-1011

Authorize Actors
2017-11-08 +00:00
Draft
2023-06-29 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Authorize Actors

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Daftar Anggota CWE

CWE-114: Process Control Dasar

CWE-15: External Control of System or Configuration Setting Dasar

CWE-219: Storage of File with Sensitive Data Under Web Root Dasar

CWE-220: Storage of File With Sensitive Data Under FTP Root Dasar

CWE-266: Incorrect Privilege Assignment Dasar

CWE-267: Privilege Defined With Unsafe Actions Dasar

CWE-268: Privilege Chaining Dasar

CWE-269: Improper Privilege Management Dasar

CWE-270: Privilege Context Switching Error Dasar

CWE-271: Privilege Dropping / Lowering Errors Dasar

CWE-272: Least Privilege Violation Dasar

CWE-273: Improper Check for Dropped Privileges Dasar

CWE-274: Improper Handling of Insufficient Privileges Dasar

CWE-276: Incorrect Default Permissions Dasar

CWE-277: Insecure Inherited Permissions Dasar

CWE-279: Incorrect Execution-Assigned Permissions Dasar

CWE-280: Improper Handling of Insufficient Permissions or Privileges Dasar

CWE-281: Improper Preservation of Permissions Dasar

CWE-282: Improper Ownership Management Dasar

CWE-283: Unverified Ownership Dasar

CWE-284: Improper Access Control Dasar

CWE-285: Improper Authorization Dasar

CWE-286: Incorrect User Management Dasar

CWE-300: Channel Accessible by Non-Endpoint Dasar

CWE-341: Predictable from Observable State Dasar

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Dasar

CWE-403: Exposure of File Descriptor to Unintended Control Sphere Dasar

CWE-419: Unprotected Primary Channel Dasar

CWE-420: Unprotected Alternate Channel Dasar

CWE-425: Direct Request Dasar

CWE-426: Untrusted Search Path Dasar

CWE-434: Unrestricted Upload of File with Dangerous Type Dasar

CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere Dasar

CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Dasar

CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere Dasar

CWE-530: Exposure of Backup File to an Unauthorized Control Sphere Dasar

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Dasar

CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Dasar

CWE-552: Files or Directories Accessible to External Parties Dasar

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Dasar

CWE-639: Authorization Bypass Through User-Controlled Key Dasar

CWE-642: External Control of Critical State Data Dasar

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Dasar

CWE-653: Improper Isolation or Compartmentalization Dasar

CWE-656: Reliance on Security Through Obscurity Dasar

CWE-668: Exposure of Resource to Wrong Sphere Dasar

CWE-669: Incorrect Resource Transfer Between Spheres Dasar

CWE-671: Lack of Administrator Control over Security Dasar

CWE-673: External Influence of Sphere Definition Dasar

CWE-708: Incorrect Ownership Assignment Dasar

CWE-732: Incorrect Permission Assignment for Critical Resource Dasar

CWE-770: Allocation of Resources Without Limits or Throttling Dasar

CWE-782: Exposed IOCTL with Insufficient Access Control Dasar

CWE-827: Improper Control of Document Type Definition Dasar

CWE-862: Missing Authorization Dasar

CWE-863: Incorrect Authorization Dasar

CWE-921: Storage of Sensitive Data in a Mechanism without Access Control Dasar

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Dasar

CWE-939: Improper Authorization in Handler for Custom URL Scheme Dasar

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains Dasar

Informasi CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
Komentar : See member weaknesses of this category.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
Joanna C.S. Santos, Mehdi Mirakhorli 2017-06-22 +00:00 2017-11-08 +00:00 2.12

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2020-02-24 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

Referensi

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.