CWE-1280 - Access Control Check Implemented After Asset is Accessed

Read Time:23 Second

Description

A product’s hardware-based access control check occurs after the asset has been accessed.

Modes of Introduction:

– Implementation

Related Weaknesses

Consequences

Access Control, Confidentiality, Integrity: Modify Memory, Read Memory, Modify Application Data, Read Application Data, Gain Privileges or Assume Identity, Bypass Protection Mechanism

Potential Mitigations

Phase: Implementation

Description:

Implement the access control check first. Access should only be given to asset if agent is authorized.

CVE References

InAccess Control Check Implemented After Asset is Accessed, CWE- 1280

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022