Incorrect User Management

Opis

The product does not properly manage a user within its environment.

Users can be assigned to the wrong group (class) of permissions resulting in unintended access rights to sensitive objects.

Skutki

• Other

  Varies by Context

Przykłady podatności

• CVE-2022-36109 Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions.
• CVE-1999-1193 Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.

Słabość nadrzędna

• CWE-284 Improper Access Control

Słabości podrzędne

• CWE-842 Placement of User into Incorrect Group

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• Operation

Dotyczy

Not Language-Specific

Uwagi

The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).

This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.