이름: Authorize Actors

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

CWE 구성원 목록

CWE-114: Process Control 기본

CWE-15: External Control of System or Configuration Setting 기본

CWE-219: Storage of File with Sensitive Data Under Web Root 기본

CWE-220: Storage of File With Sensitive Data Under FTP Root 기본

CWE-266: Incorrect Privilege Assignment 기본

CWE-267: Privilege Defined With Unsafe Actions 기본

CWE-268: Privilege Chaining 기본

CWE-269: Improper Privilege Management 기본

CWE-270: Privilege Context Switching Error 기본

CWE-271: Privilege Dropping / Lowering Errors 기본

CWE-272: Least Privilege Violation 기본

CWE-273: Improper Check for Dropped Privileges 기본

CWE-274: Improper Handling of Insufficient Privileges 기본

CWE-276: Incorrect Default Permissions 기본

CWE-277: Insecure Inherited Permissions 기본

CWE-279: Incorrect Execution-Assigned Permissions 기본

CWE-280: Improper Handling of Insufficient Permissions or Privileges 기본

CWE-281: Improper Preservation of Permissions 기본

CWE-282: Improper Ownership Management 기본

CWE-283: Unverified Ownership 기본

CWE-284: Improper Access Control 기본

CWE-285: Improper Authorization 기본

CWE-286: Incorrect User Management 기본

CWE-300: Channel Accessible by Non-Endpoint 기본

CWE-341: Predictable from Observable State 기본

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 기본

CWE-403: Exposure of File Descriptor to Unintended Control Sphere 기본

CWE-419: Unprotected Primary Channel 기본

CWE-420: Unprotected Alternate Channel 기본

CWE-425: Direct Request 기본

CWE-426: Untrusted Search Path 기본

CWE-434: Unrestricted Upload of File with Dangerous Type 기본

CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 기본

CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 기본

CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 기본

CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 기본

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 기본

CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 기본

CWE-552: Files or Directories Accessible to External Parties 기본

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 기본

CWE-639: Authorization Bypass Through User-Controlled Key 기본

CWE-642: External Control of Critical State Data 기본

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 기본

CWE-653: Improper Isolation or Compartmentalization 기본

CWE-656: Reliance on Security Through Obscurity 기본

CWE-668: Exposure of Resource to Wrong Sphere 기본

CWE-669: Incorrect Resource Transfer Between Spheres 기본

CWE-671: Lack of Administrator Control over Security 기본

CWE-673: External Influence of Sphere Definition 기본

CWE-708: Incorrect Ownership Assignment 기본

CWE-732: Incorrect Permission Assignment for Critical Resource 기본

CWE-770: Allocation of Resources Without Limits or Throttling 기본

CWE-782: Exposed IOCTL with Insufficient Access Control 기본

CWE-827: Improper Control of Document Type Definition 기본

CWE-862: Missing Authorization 기본

CWE-863: Incorrect Authorization 기본

CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 기본

CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 기본

CWE-939: Improper Authorization in Handler for Custom URL Scheme 기본

CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 기본

CWE 정보

취약점 매핑 메모

근거 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
댓글 : See member weaknesses of this category.

제출

이름	조직	날짜	출시일	Version
Joanna C.S. Santos, Mehdi Mirakhorli		2017-06-22 +00:00	2017-11-08 +00:00	2.12

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2020-02-24 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

참고 자료

REF-9

A Catalog of Security Architecture Weaknesses.
Santos, J. C. S., Tarrit, K., Mirakhorli, M..
https://ieeexplore.ieee.org/document/7958491

REF-10

Understanding Software Vulnerabilities Related to Architectural Security Tactics: An Empirical Investigation of Chromium, PHP and Thunderbird.
Santos, J. C. S., Peruma, A., Mirakhorli, M., Galster, M., Sejfia, A..
https://ieeexplore.ieee.org/document/7930201

CWE-1011 카테고리 상세 정보

CWE-1011