COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1280

Access Control Check Implemented After Asset is Accessed

A product's hardware-based access control check occurs after the asset has been accessed.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

A product's hardware-based access control check occurs after the asset has been accessed.

Genişletilmiş açıklama

The product implements a hardware-based access control check. The asset should be accessible only after the check is successful. If, however, this operation is not atomic and the asset is accessed before the check is complete, the security of the system may be compromised.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Modify MemoryRead MemoryModify Application DataRead Application DataGain Privileges or Assume IdentityBypass Protection Mechanism

Etkilenen güvenlik alanları: Access Control, Confidentiality, Integrity

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
Implement the access control check first. Access should only be given to asset if agent is authorized.