{"@ID": "284", "@Name": "Improper Access Control", "@Abstraction": "Pillar", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.", "Extended_Description": {"xhtml:p": ["Access control involves the use of several protection mechanisms such as:", "When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.", "There are two distinct behaviors that can introduce access control weaknesses:"], "xhtml:ul": [{"xhtml:li": ["Authentication (proving the identity of an actor)", "Authorization (ensuring that a given actor can access a resource), and", "Accountability (tracking of activities that were performed)"]}, {"xhtml:li": ["Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.", "Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies."]}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Often"}, "Technology": [{"@Class": "Not Technology-Specific", "@Prevalence": "Often"}, {"@Class": "ICS/OT", "@Prevalence": "Often"}, {"@Class": "Web Based", "@Prevalence": "Often"}]}, "Alternate_Terms": {"Alternate_Term": {"Term": "Authorization", "Description": "The terms \"access control\" and \"authorization\" are often used interchangeably, although many people have distinct definitions. The CWE usage of \"access control\" is intended as a general term for the various mechanisms that restrict which users can access which resources, and \"authorization\" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms."}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design"}, {"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}, {"Phase": "Operation"}]}, "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": "Varies by Context"}}, "Potential_Mitigations": {"Mitigation": [{"@Mitigation_ID": "MIT-1", "Phase": ["Architecture and Design", "Operation"], "Description": "Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software."}, {"@Mitigation_ID": "MIT-46", "Phase": "Architecture and Design", "Strategy": "Separation of Privilege", "Description": {"xhtml:p": ["Compartmentalize the system to have \"safe\" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.", "Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges."]}}]}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-126", "Intro_Text": "This code temporarily raises the program's privileges to allow creation of a new user folder.", "Example_Code": {"@Nature": "Bad", "@Language": "Python", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": [{"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:i": "#avoid CWE-22 and CWE-78", "#text": "print('Usernames cannot contain invalid characters')return False"}}, {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "raisePrivileges()os.mkdir('/home/' + username)lowerPrivileges()"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "print('Unable to create new user directory for user:' + username)return False"}], "xhtml:br": [null, null, null], "#text": "if invalidUsername(username):\n                           try:\n                           except OSError:\n                           return True"}}, "#text": "def makeNewUserDir(username):"}}, "Body_Text": "While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur."}, {"@Demonstrative_Example_ID": "DX-95", "Intro_Text": "This function runs an arbitrary SQL query on a given database, returning the result of the query.", "Example_Code": {"@Nature": "Bad", "@Language": "PHP", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "xhtml:i": "//Use a prepared statement to avoid CWE-89", "#text": "mysql_select_db($dbName,$globalDbHandle) or die(\"Could not open Database\".$dbName);\n                        \n                        $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');$preparedStatement->execute(array(':name' => $name));return $preparedStatement->fetchAll();"}, "xhtml:br": [null, null, null], "xhtml:i": "/.../", "#text": "function runEmployeeQuery($dbName, $name){}\n                     \n                     \n                     $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);"}}, "Body_Text": "While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database."}, {"@Demonstrative_Example_ID": "DX-153", "Intro_Text": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.", "Body_Text": "Multiple vendors did not use any authentication or used client-side authentication for critical functionality in their OT products."}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2023-26463", "Description": "Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)", "Link": "https://www.cve.org/CVERecord?id=CVE-2023-26463"}, {"Reference": "CVE-2022-24985", "Description": "A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-24985"}, {"Reference": "CVE-2022-29238", "Description": "Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-29238"}, {"Reference": "CVE-2022-23607", "Description": "Python-based HTTP library did not scope cookies to a particular domain such that \"supercookies\" could be sent to any domain on redirect", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-23607"}, {"Reference": "CVE-2021-21972", "Description": "Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-21972"}, {"Reference": "CVE-2021-37415", "Description": "IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-37415"}, {"Reference": "CVE-2021-35033", "Description": "Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-35033"}, {"Reference": "CVE-2020-10263", "Description": "Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-10263"}, {"Reference": "CVE-2020-13927", "Description": "Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2020-13927"}, {"Reference": "CVE-2010-4624", "Description": "Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-4624"}]}, "Affected_Resources": {"Affected_Resource": "File or Directory"}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "PLOVER", "Entry_Name": "Access Control List (ACL) errors"}, {"@Taxonomy_Name": "WASC", "Entry_ID": "2", "Entry_Name": "Insufficient Authorization"}, {"@Taxonomy_Name": "7 Pernicious Kingdoms", "Entry_Name": "Missing Access Control"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "19"}, {"@CAPEC_ID": "441"}, {"@CAPEC_ID": "478"}, {"@CAPEC_ID": "479"}, {"@CAPEC_ID": "502"}, {"@CAPEC_ID": "503"}, {"@CAPEC_ID": "536"}, {"@CAPEC_ID": "546"}, {"@CAPEC_ID": "550"}, {"@CAPEC_ID": "551"}, {"@CAPEC_ID": "552"}, {"@CAPEC_ID": "556"}, {"@CAPEC_ID": "558"}, {"@CAPEC_ID": "562"}, {"@CAPEC_ID": "563"}, {"@CAPEC_ID": "564"}, {"@CAPEC_ID": "578"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-7", "@Section": "Chapter 6, \"Determining Appropriate Access Control\" Page 171"}, {"@External_Reference_ID": "REF-44", "@Section": "\"Sin 17: Failure to Protect Stored Data.\" Page 253"}, {"@External_Reference_ID": "REF-1287", "@Section": "Details of Problematic Mappings"}, {"@External_Reference_ID": "REF-1283"}]}, "Mapping_Notes": {"Usage": "Discouraged", "Rationale": "CWE-284 is extremely high-level, a Pillar. Its name, \"Improper Access Control,\" is often misused in low-information vulnerability reports [REF-1287] or by active use of the OWASP Top Ten, such as \"A01:2021-Broken Access Control\". It is not useful for trend analysis.", "Comments": "Consider using descendants-284 that are more specific to the kind of access control involved.", "Reasons": {"Reason": [{"@Type": "Frequent Misuse"}, {"@Type": "Frequent Misinterpretation"}, {"@Type": "Abstraction"}]}, "Suggestions": {"Suggestion": [{"@CWE_ID": "862", "@Comment": "Missing Authorization"}, {"@CWE_ID": "863", "@Comment": "Incorrect Authorization"}, {"@CWE_ID": "732", "@Comment": "Incorrect Permission Assignment for Critical Resource"}, {"@CWE_ID": "306", "@Comment": "Missing Authentication"}, {"@CWE_ID": "1390", "@Comment": "Weak Authentication"}, {"@CWE_ID": "286", "@Comment": "Incorrect User Management"}, {"@CWE_ID": "923", "@Comment": "Improper Restriction of Communication Channel to Intended Endpoints"}]}}, "Notes": {"Note": {"@Type": "Maintenance", "xhtml:p": "This entry needs more work. Possible sub-categories include:", "xhtml:ul": {"xhtml:li": ["Trusted group includes undesired entities (partially covered by CWE-286)", "Group can perform undesired actions", "ACL parse error does not fail closed"]}}}, "Content_History": {"Submission": {"Submission_Name": "PLOVER", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-10-14", "Modification_Version": "1.0.1", "Modification_ReleaseDate": "2008-10-14", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-07-27", "Modification_Version": "1.5", "Modification_ReleaseDate": "2009-07-27", "Modification_Comment": "updated Alternate_Terms, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-12-28", "Modification_Version": "1.7", "Modification_ReleaseDate": "2009-12-28", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-02-16", "Modification_Version": "1.8", "Modification_ReleaseDate": "2010-02-16", "Modification_Comment": "updated References, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-06-21", "Modification_Version": "1.9", "Modification_ReleaseDate": "2010-06-21", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-03-24", "Modification_Version": "1.12", "Modification_ReleaseDate": "2011-03-30", "Modification_Importance": "Critical", "Modification_Comment": "Changed name and description; clarified difference between \"access control\" and \"authorization.\""}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-03-29", "Modification_Version": "1.12", "Modification_ReleaseDate": "2011-03-30", "Modification_Comment": "updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-27", "Modification_Version": "2.0", "Modification_ReleaseDate": "2011-06-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-02-18", "Modification_Version": "2.6", "Modification_ReleaseDate": "2014-02-19", "Modification_Comment": "updated Related_Attack_Patterns, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2015-12-07", "Modification_Version": "2.9", "Modification_ReleaseDate": "2015-12-07", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Affected_Resources, Modes_of_Introduction, Observed_Examples, References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2018-03-27", "Modification_Version": "3.1", "Modification_ReleaseDate": "2018-03-27", "Modification_Comment": "updated References, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-06-20", "Modification_Version": "3.3", "Modification_ReleaseDate": "2019-06-20", "Modification_Comment": "updated Related_Attack_Patterns, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Taxonomy_Mappings, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-12-10", "Modification_Version": "4.3", "Modification_ReleaseDate": "2020-12-10", "Modification_Comment": "updated Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Maintenance_Notes, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-07-20", "Modification_Version": "4.5", "Modification_ReleaseDate": "2021-07-20", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-10-28", "Modification_Version": "4.6", "Modification_ReleaseDate": "2021-10-28", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-06-28", "Modification_Version": "4.8", "Modification_ReleaseDate": "2022-06-28", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Applicable_Platforms, Description, Observed_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Demonstrative_Examples, Mapping_Notes, Observed_Examples, References, Relationships, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-01-21", "Modification_Version": "4.19.1", "Modification_ReleaseDate": "2026-01-21", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Mapping_Notes"}], "Previous_Entry_Name": [{"@Date": "2008-09-09", "#text": "Access Control Issues"}, {"@Date": "2011-03-29", "#text": "Access Control (Authorization) Issues"}]}}