CWE-272Least Privilege Violation

Description

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Common consequences

• Access Control,Confidentiality→Gain Privileges or Assume Identity,Read Application Data,Read Files or Directories
  An attacker may be able to access resources with the elevated privilege that could not be accessed with the attacker's original privileges. This is particularly likely in conjunction with another flaw, such as a buffer overflow.

Potential mitigations

• Architecture and Design,Operation
  Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
• Architecture and Design
  Follow the principle of least privilege when assigning access rights to entities in a software system.
• Architecture and Design
  [object Object]

Related CWEs

Recent CVEs classified under this CWE