CWE-286
Incorrect User Management
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Incorrect User Management
The product does not properly manage a user within its environment.
Mô tả CWE
Users can be assigned to the wrong group (class) of permissions.
Thông tin chung
Các cách xuất hiện
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation
Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Access Control | Varies by Context, Gain Privileges or Assume Identity Ghi chú: Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2022-36109 | Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions. |
CVE-1999-1193 | Operating system assigns user to privileged wheel group, allowing the user to gain root privileges. |
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is a Class and might have Base-level children that would be more appropriateBình luận : Examine children of this entry to see if there is a better fit
Ghi chú
The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Maintenance_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
