Category-265: 权限/沙箱问题
ID: 265
Status: Incomplete
Summary
Weaknesses in this category occur with improper enforcement of sandbox environments, or the improper handling, assignment, or management of privileges.
Membership
Taxonomy Mappings
| Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Privilege / sandbox errors |
Notes
Relationship
This can strongly overlap authorization errors.
Theoretical
A sandbox could be regarded as an explicitly defined sphere of control, in that the sandbox only defines a limited set of behaviors, which can only access a limited set of resources.
Theoretical
It could be argued that any privilege problem occurs within the context of a sandbox.
Research Gap
Many of the following concepts require deeper study. Most privilege problems are not classified at such a low level of detail, and terminology is very sparse. Certain classes of software, such as web browsers and software bug trackers, provide a rich set of examples for further research. Operating systems have matured to the point that these kinds of weaknesses are rare, but finer-grained models for privileges, capabilities, or roles might introduce subtler issues.
文章来源于互联网:scap中文网
CWE-1102 依赖于机器相关的数据表示 Reliance on Machine-Dependent Data Representation 结构: Simple Abstraction: Base 状态: Incomplete 被利用可能性: unkown…
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论