CWE-282: Improper Ownership Management
Improper Ownership Management
Weakness ID: 282 (Weakness Class) Status: Draft
Description
Description Summary
The software assigns the wrong ownership, or does not properly
verify the ownership, of an object or resource.
Time of Introduction
Observed Examples
Reference Description CVE-1999-1125 Program runs setuid root but relies on a
configuration file owned by a non-root user.
Potential Mitigations
ID Phase Description 1 Very carefully manage the setting, management and handling of
privileges and permissions. Explicitly manage trust zones in the
software.
Relationships
Affected Resources
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Ownership errors
Maintenance Notes
The relationships between privileges, permissions, and actors (e.g. users
and groups) need further refinement within the Research view. One
complication is that these concepts apply to two different pillars, related
to control of resources (CWE-664) and protection mechanism failures
(CWE-396).
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-09-08 CWE Content Team MITRE Internal updated Maintenance Notes, Relationships,
Taxonomy Mappings
Description
