Read Time:25 Second
Description
Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
The use of impersonated credentials allows an ASP.NET application to run with either the privileges of the client on whose behalf it is executing or with arbitrary privileges granted in its configuration.
Modes of Introduction:
– Implementation
Related Weaknesses
Consequences
Access Control: Gain Privileges or Assume Identity
Potential Mitigations
Phase: Architecture and Design
Description:
Use the least privilege principle.