Description
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-284
Consequences
Confidentiality, Integrity, Availability, Access Control: Modify Memory, Read Memory, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Other
Potential Mitigations
Phase: Architecture and Design, Implementation, Testing
Effectiveness: High
Description:
CVE References
