名稱: Incorrect User Management
The product does not properly manage a user within its environment.
CWE 描述
Users can be assigned to the wrong group (class) of permissions.
一般資訊
引入方式
Architecture and DesignImplementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Operation
適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control | Varies by Context, Gain Privileges or Assume Identity 注意：Users may be given unintended access rights to sensitive objects, or assigned to the wrong group (class) of permissions. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2022-36109 | Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions. |
CVE-1999-1193 | Operating system assigns user to privileged wheel group, allowing the user to gain root privileges. |
漏洞對應備注
理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate備註 : Examine children of this entry to see if there is a better fit
備注
The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Maintenance_Notes, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Dimensions |
