CWE-268—Privilege Chaining

PUBLISHEDweakness recordHigh
released 2006-07-19 · last modified 2023-06-29

Metadata

CWE ID：
CWE-268
摘要：
Base
结构：
Simple
状态：
Draft
发布日期：
2006-07-19
更新日期：
2023-06-29

名称

Privilege Chaining

描述

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

常见后果

范围：
Access Control
影响：
Gain Privileges or Assume Identity
注释：
A user can be given or gain access rights of another user. This can give the user unauthorized access to sensitive information including the access information of another user.

相关 CWE

browse all CWEs