CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.6)  

CWE-274: Improper Handling of Insufficient Privileges

 
Improper Handling of Insufficient Privileges
Weakness ID: 274 (Weakness Base)Status: Draft
+ Description

Description Summary

The software does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-2001-1564System limits are not properly enforced after privileges are dropped.
CVE-2005-3286Firewall crashes when it can't read a critical memory block that was protected by a malicious process.
CVE-2005-1641Does not give admin sufficient privileges to overcome otherwise legitimate user actions.
+ Weakness Ordinalities
OrdinalityDescription
Primary
(where the weakness exists independent of other weaknesses)
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory265Privilege / Sandbox Issues
Development Concepts (primary)699
ChildOfWeakness BaseWeakness Base269Improper Privilege Management
Research Concepts1000
PeerOfWeakness ClassWeakness Class271Privilege Dropping / Lowering Errors
Research Concepts1000
CanAlsoBeWeakness BaseWeakness Base280Improper Handling of Insufficient Permissions or Privileges
Research Concepts1000
ChildOfWeakness ClassWeakness Class703Failure to Handle Exceptional Conditions
Research Concepts (primary)1000
+ Relationship Notes

Overlaps dropped privileges, insufficient permissions.

This has a layering relationship with Unchecked Error Condition and Unchecked Return Value.

+ Theoretical Notes

Within the context of vulnerability theory, privileges and permissions are two sides of the same coin. Privileges are associated with actors, and permissions are associated with resources. To perform access control, at some point the software makes a decision about whether the actor (and the privileges that have been assigned to that actor) is allowed to access the resource (based on the permissions that have been specified for that resource).

+ Causal Nature

Explicit

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERInsufficient privileges
+ Maintenance Notes

CWE-280 and CWE-274 are too similar. It is likely that CWE-274 will be deprecated in the future.

+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Description, Maintenance Notes, Relationships, Relationship Notes, Taxonomy Mappings, Weakness Ordinalities
2009-03-10CWE Content TeamMITREInternal
updated Maintenance Notes, Theoretical Notes
2009-05-27CWE Content TeamMITREInternal
updated Description, Name
Back to top
Page Last Updated: October 29, 2009
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2009, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us