CWE-269Improper Privilege Management

Description

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Common consequences

• Access Control→Gain Privileges or Assume Identity

Potential mitigations

• Architecture and Design,Operation
  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
• Architecture and Design
  Follow the principle of least privilege when assigning access rights to entities in a software system.
• Architecture and Design
  Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Related CWEs

Recent CVEs classified under this CWE