Privilege / Sandbox Issues
Category ID: 265 (Category)Status: Incomplete
+ Description

Description Summary

Weaknesses in this category occur with improper enforcement of sandbox environments, or the improper handling, assignment, or management of privileges.
+ Potential Mitigations

Very carefully manage the setting, management and handling of privileges. Explicitly manage trust zones in the software.

Follow the principle of least privilege when assigning access rights to entities in a software system.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory264Permissions, Privileges, and Access Controls
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base266Incorrect Privilege Assignment
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base267Privilege Defined With Unsafe Actions
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base268Privilege Chaining
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base269Improper Privilege Management
Development Concepts (primary)699
ParentOfWeakness ClassWeakness Class271Privilege Dropping / Lowering Errors
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base274Improper Handling of Insufficient Privileges
Development Concepts (primary)699
ParentOfWeakness ClassWeakness Class610Externally Controlled Reference to a Resource in Another Sphere
Development Concepts (primary)699
ParentOfWeakness BaseWeakness Base648Incorrect Use of Privileged APIs
Development Concepts (primary)699
PeerOfWeakness ClassWeakness Class250Execution with Unnecessary Privileges
Research Concepts1000
PeerOfWeakness BaseWeakness Base619Dangling Database Cursor ('Cursor Injection')
Research Concepts1000
+ Relationship Notes

This can strongly overlap authorization errors.

+ Research Gaps

Many of the following concepts require deeper study. Most privilege problems are not classified at such a low level of detail, and terminology is very sparse. Certain classes of software, such as web browsers and software bug trackers, provide a rich set of examples for further research. Operating systems have matured to the point that these kinds of weaknesses are rare, but finer-grained models for privileges, capabilities, or roles might introduce subtler issues.

+ Theoretical Notes

A sandbox could be regarded as an explicitly defined sphere of control, in that the sandbox only defines a limited set of behaviors, which can only access a limited set of resources.

It could be argued that any privilege problem occurs within the context of a sandbox.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERPrivilege / sandbox errors
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-09-08CWE Content TeamMITREInternal
updated Description, Relationships, Relationship Notes, Taxonomy Mappings, Theoretical Notes
2008-10-14CWE Content TeamMITREInternal
updated Description, Research Gaps, Theoretical Notes
2009-12-28CWE Content TeamMITREInternal
updated Potential Mitigations
Back to top