COMMON WEAKNESS ENUMERATIONDraft

CWE-283

Unverified Ownership

The product does not properly verify that a critical resource is owned by the proper entity.

Abstraction

Base

Structure

Simple

Likelihood of Exploit

Medium

Understand the problem

What is the problem?

The product does not properly verify that a critical resource is owned by the proper entity.

Root cause

How and when does the problem arise?

Lifecycle phase

Architecture and Design

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Risk

What does successful exploitation lead to?

Gain Privileges or Assume Identity

Affected security scopes: Access Control

An attacker could gain unauthorized access to system resources.

Defence

How is it prevented and fixed?

Architecture and Design · Operation

Defence to apply across several lifecycle phases

Detail
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design

Separation of Privilege

Detail
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.