Authorize Actors

Opis

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Wpisy w tej grupie

• CWE-114 Process Control
• CWE-15 External Control of System or Configuration Setting
• CWE-219 Storage of File with Sensitive Data Under Web Root
• CWE-220 Storage of File With Sensitive Data Under FTP Root
• CWE-266 Incorrect Privilege Assignment
• CWE-267 Privilege Defined With Unsafe Actions
• CWE-268 Privilege Chaining
• CWE-269 Improper Privilege Management
• CWE-270 Privilege Context Switching Error
• CWE-271 Privilege Dropping / Lowering Errors
• CWE-272 Least Privilege Violation
• CWE-273 Improper Check for Dropped Privileges
• CWE-274 Improper Handling of Insufficient Privileges
• CWE-276 Incorrect Default Permissions
• CWE-277 Insecure Inherited Permissions
• CWE-279 Incorrect Execution-Assigned Permissions
• CWE-280 Improper Handling of Insufficient Permissions or Privileges
• CWE-281 Improper Preservation of Permissions
• CWE-282 Improper Ownership Management
• CWE-283 Unverified Ownership
• CWE-284 Improper Access Control
• CWE-285 Improper Authorization
• CWE-286 Incorrect User Management
• CWE-300 Channel Accessible by Non-Endpoint
• CWE-341 Predictable from Observable State
• CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
• CWE-403 Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
• CWE-419 Unprotected Primary Channel
• CWE-420 Unprotected Alternate Channel
• CWE-425 Direct Request ('Forced Browsing')
• CWE-426 Untrusted Search Path
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere
• CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere
• CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere
• CWE-530 Exposure of Backup File to an Unauthorized Control Sphere
• CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
• CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
• CWE-552 Files or Directories Accessible to External Parties
• CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-642 External Control of Critical State Data
• CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
• CWE-653 Improper Isolation or Compartmentalization
• CWE-656 Reliance on Security Through Obscurity
• CWE-668 Exposure of Resource to Wrong Sphere
• CWE-669 Incorrect Resource Transfer Between Spheres
• CWE-671 Lack of Administrator Control over Security
• CWE-673 External Influence of Sphere Definition
• CWE-708 Incorrect Ownership Assignment
• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-782 Exposed IOCTL with Insufficient Access Control
• CWE-827 Improper Control of Document Type Definition
• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization
• CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
• CWE-939 Improper Authorization in Handler for Custom URL Scheme
• CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains

Źródła