CWE-283: Unverified Ownership
Description
The product does not properly verify that a critical resource is owned by the proper entity.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Gain Privileges or Assume Identity
An attacker could gain unauthorized access to system resources.
Potential mitigations
- Architecture and DesignOperation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and DesignSeparation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.