CWE-267: Privilege Defined With Unsafe Actions
Description
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Submission Date :
July 19, 2006, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Example - 1
This code intends to allow only Administrators to print debug information about a system. While the intention was to only allow Administrators to print the debug information, the code as written only excludes those with the role of "GUEST". Someone with the role of "ADMIN" or "USER" will be allowed access, which goes against the original intent. An attacker may be able to use this debug information to craft an attack on the system.ADMIN,USER,GUEST
System.out.println("You are not authorized to perform this command");break;
System.out.println(currentDebugState());break;case GUEST:default:switch(requestingUser.role){}
System.out.println("You must be logged in to perform this command");if(isAuthenticated(requestingUser)){}else{}public enum Roles {}public void printDebugInfo(User requestingUser){}
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
Visit http://cwe.mitre.org/ for more details.