이름: Incorrect User Management

The product does not properly manage a user within its environment.

CWE 설명

Users can be assigned to the wrong group (class) of permissions.

일반 정보

취약점 도입 방식

Architecture and Design
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control	Varies by Context, Gain Privileges or Assume Identity 참고: Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions.

관찰된 예시

참고 자료	설명
CVE-2022-36109	Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions.
CVE-1999-1193	Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.

취약점 매핑 메모

근거 : This CWE entry is a Class and might have Base-level children that would be more appropriate
댓글 : Examine children of this entry to see if there is a better fit

메모

The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).
This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2011-03-29 +00:00	updated Applicable_Platforms, Maintenance_Notes, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-06-27 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Dimensions

CWE-286 상세 정보

CWE-286