CWE-283 — Unverified Ownership

provenance: imported · CWE: CWE-283

CWE-283: Unverified Ownership

MITRE CWE weakness


Kind	Weakness
Abstraction	Base
Status	Draft
Likelihood of exploit	—

Description

The product does not properly verify that a critical resource is owned by the proper entity.

Common consequences

Access Control: Gain Privileges or Assume Identity

Mitigations

Architecture and Design — Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design — Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

CWE page: https://cwe.mitre.org/data/definitions/283.html
CWE list: https://cwe.mitre.org/data/index.html