CWE-668: Exposure of Resource to Wrong Sphere
Description
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Submission Date :
April 11, 2008, midnight
Modification Date :
2023-06-29 00:00:00+00:00
Organization :
MITRE
Extended Description
Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
In either case, the end result is that a resource has been exposed to the wrong party.
Related Weaknesses
This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined to give an overview of the different insight to similar items that may exist at higher and lower levels of abstraction.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-134: Use of Externally-Controlled Format String
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-374: Passing Mutable Objects to an Untrusted Method
CWE-375: Returning a Mutable Object to an Untrusted Caller
CWE-377: Insecure Temporary File
CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
CWE-426: Untrusted Search Path
CWE-427: Uncontrolled Search Path Element
CWE-428: Unquoted Search Path or Element
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-488: Exposure of Data Element to Wrong Session
CWE-491: Public cloneable() Method Without Final ('Object Hijack')
CWE-492: Use of Inner Class Containing Sensitive Data
CWE-493: Critical Public Variable Without Final Modifier
CWE-498: Cloneable Class Containing Sensitive Information
CWE-499: Serializable Class Containing Sensitive Data
CWE-522: Insufficiently Protected Credentials
CWE-524: Use of Cache Containing Sensitive Information
CWE-552: Files or Directories Accessible to External Parties
CWE-582: Array Declared Public, Final, and Static
CWE-583: finalize() Method Declared Public
CWE-608: Struts: Non-private Field in ActionForm Class
CWE-642: External Control of Critical State Data
CWE-664: Improper Control of a Resource Through its Lifetime
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-767: Access to Critical Private Variable via Public Method
CWE-927: Use of Implicit Intent for Sensitive Communication
CWE-942: Permissive Cross-domain Policy with Untrusted Domains
CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory
CWE-1327: Binding to an Unrestricted IP Address
CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC)
Visit http://cwe.mitre.org/ for more details.