Authorization Errors

Opis

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Wpisy w tej grupie

• CWE-425 Direct Request ('Forced Browsing')
• CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
• CWE-552 Files or Directories Accessible to External Parties
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-653 Improper Isolation or Compartmentalization
• CWE-939 Improper Authorization in Handler for Custom URL Scheme
• CWE-842 Placement of User into Incorrect Group
• CWE-1220 Insufficient Granularity of Access Control
• CWE-1230 Exposure of Sensitive Information Through Metadata