CWE-638—Not Using Complete Mediation
PUBLISHEDweakness record
released 2008-01-30 · last modified 2023-10-26
Metadata
- CWE ID：
- CWE-638
- 摘要：
- Class
- 结构：
- Simple
- 状态：
- Draft
- 发布日期：
- 2008-01-30
- 更新日期：
- 2023-10-26
名称
Not Using Complete Mediation
描述
The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
常见后果
- 范围：
- Integrity, Confidentiality, Availability, Access Control, Other
- 影响：
- Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Other
- 注释：
- A user might retain access to a critical resource even after privileges have been revoked, possibly allowing access to privileged functionality or sensitive information, depending on the role of the resource.