CWE-269: Improper Privilege Management
Improper Privilege Management
Weakness ID: 269 (Weakness Base) Status: Incomplete
Description
Description Summary
The software does not properly assign, modify, or track
privileges for an actor, creating an unintended sphere of control for that
actor.
Time of Introduction
Architecture and Design
Implementation
Operation
Likelihood of Exploit
Observed Examples
Reference Description CVE-2001-1555 Terminal privileges are not reset when a user logs
out. CVE-2001-1514 Does not properly pass security context to child
processes in certain cases, allows privilege
escalation. CVE-2001-0128 Does not properly compute
roles.
Potential Mitigations
ID Phase Description 1 Very carefully manage the setting, management and handling of
privileges. Explicitly manage trust zones in the software.
Follow the principle of least privilege when assigning access rights
to entities in a software system.
Consider following the principle of separation of privilege. Require
multiple conditions to be met before permitting access to a system
resource.
Weakness Ordinalities
Ordinality Description Primary
(where the
weakness exists independent of other weaknesses)
Relationships
Causal Nature
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Privilege Management Error
Maintenance Notes
The relationships between privileges, permissions, and actors (e.g. users
and groups) need further refinement within the Research view. One
complication is that these concepts apply to two different pillars, related
to control of resources (CWE-664) and protection mechanism failures
(CWE-396).
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-09-08 CWE Team Internal Moved this entry higher up in the Research
view. 2008-09-08 CWE Content Team MITRE Internal updated Description, Maintenance Notes, Name,
Relationships, Taxonomy Mappings,
Weakness Ordinalities 2009-05-27 CWE Content Team MITRE Internal updated Name
Description
