CWE-708: Incorrect Ownership Assignment
Description
The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
This may allow the resource to be manipulated by actors outside of the intended control sphere.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- ConfidentialityIntegrity
Read Application Data; Modify Application Data
An attacker could read and modify data for which they do not have permissions to access directly.
Potential mitigations
- Policy
Periodically review the privileges and their owners.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.