名称: Incorrect User Management
The product does not properly manage a user within its environment.
CWE 描述
Users can be assigned to the wrong group (class) of permissions.
基本信息
引入方式
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation
适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Access Control | Varies by Context, Gain Privileges or Assume Identity 注意： Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2022-36109 | Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions. |
CVE-1999-1193 | Operating system assigns user to privileged wheel group, allowing the user to gain root privileges. |
漏洞映射说明
依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate备注 : Examine children of this entry to see if there is a better fit
备注
The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Maintenance_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
