CWE-668 詳細

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

導入モード

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

一般的な結果

脆弱性マッピングノート

理由 : CWE-668 is high-level and is often misused as a catch-all when lower-level children might be applicable. It is sometimes used for low-information vulnerability reports [REF-1287]. It is a level-1 Class (i.e., a child of a Pillar). It is not useful for trend analysis.
コメント : Frequent misuse appears to be related to access control issues (poor authorization (CWE-285) or authentication (CWE-287)); insertion of sensitive information (CWE-201) or improper removal of sensitive information (CWE-212); insecure permissions (CWE-732 and descendants); or others. Closely analyze the specific mistake that is allowing the resource to be exposed, and perform a CWE mapping for that mistake. It is highly likely that CWE-668's children or descendants could apply.

ノート

A "control sphere" is a set of resources and behaviors that are accessible to a single actor, or a group of actors. A product's security model will typically define multiple spheres, possibly implicitly. For example, a server might define one sphere for "administrators" who can create new user accounts with subdirectories under /home/server/, and a second sphere might cover the set of users who can create or delete files within their own subdirectories. A third sphere might be "users who are authenticated to the operating system on which the product is installed." Each sphere has different sets of actors and allowable behaviors.

参考文献

REF-1287

Supplemental Details - 2022 CWE Top 25
MITRE.
https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails

登録情報

変更履歴