CWE-269 — Improper Privilege Management
CWE-269: Improper Privilege Management
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Class |
| Status | Draft |
| Likelihood of exploit | Medium |
Description
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Common consequences
- Access Control: Gain Privileges or Assume Identity
Mitigations
Architecture and Design — Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design — Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design — Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
References
- CWE page: https://cwe.mitre.org/data/definitions/269.html
- CWE list: https://cwe.mitre.org/data/index.html