名前: Incorrect User Management
The product does not properly manage a user within its environment.
CWE の説明
Users can be assigned to the wrong group (class) of permissions.
一般情報
導入モード
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)一般的な結果
| スコープ | 影響 | 可能性 |
|---|---|---|
| Access Control | Varies by Context, Gain Privileges or Assume Identity 注記：Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions. |
観察された例
| 参考文献 | 説明 |
|---|---|
CVE-2022-36109 | Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions. |
CVE-1999-1193 | Operating system assigns user to privileged wheel group, allowing the user to gain root privileges. |
脆弱性マッピングノート
理由 : This CWE entry is a Class and might have Base-level children that would be more appropriateコメント : Examine children of this entry to see if there is a better fit
ノート
The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.
登録情報
| 名前 | 組織 | 日付 | リリース日 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
変更履歴
| 名前 | 組織 | 日付 | コメント |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Maintenance_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
