CWE-272—Least Privilege Violation
PUBLISHEDweakness record
released 2006-07-19 · last modified 2025-09-09
Metadata
- CWE ID：
- CWE-272
- 摘要：
- Base
- 结构：
- Simple
- 状态：
- Incomplete
- 发布日期：
- 2006-07-19
- 更新日期：
- 2025-09-09
名称
Least Privilege Violation
描述
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
常见后果
- 范围：
- Access Control, Confidentiality
- 影响：
- Gain Privileges or Assume Identity, Read Application Data, Read Files or Directories
- 注释：
- An attacker may be able to access resources with the elevated privilege that could not be accessed with the attacker's original privileges. This is particularly likely in conjunction with another flaw, such as a buffer overflow.