CWE-424 对候选路径的不恰当保护

Improper Protection of Alternate Path

结构: Simple

Abstraction: Class

状态: Draft

被利用可能性: unkown

基本描述

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 693 cwe_View_ID: 1000

• cwe_Nature: ChildOf cwe_CWE_ID: 638 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
Access Control	['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity']

可能的缓解方案

Architecture and Design

策略:

Deploy different layers of protection to implement security in depth.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Alternate Path Errors
Software Fault Patterns	SFP35		Insecure resource access

相关攻击模式

• CAPEC-127
• CAPEC-554

文章来源于互联网:scap中文网