CWE-653—Improper Isolation or Compartmentalization

名称

Improper Isolation or Compartmentalization

描述

The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.

常见后果

范围：

Access Control

影响：

Gain Privileges or Assume Identity, Bypass Protection Mechanism

注释：

The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles.

相关 CWE

• CWE-657Violation of Secure Design Principles
• CWE-693Protection Mechanism Failure