ByteOS Network

CWE-842:Placement of User into Incorrect Group

Weakness ID:842

Version:v4.17

Weakness Name:Placement of User into Incorrect Group

Vulnerability Mapping:Allowed

Abstraction:Base

Structure:Simple

Status:Incomplete

Details Content History Observed CVE Examples Reports

▼Description

The product or the administrator places a user into an incorrect group.

▼Extended Description

If the incorrect group has more access or privileges than the intended group, the user might be able to bypass intended security policy to access unexpected resources or perform unexpected actions. The access-control system might not be able to detect malicious usage of this group membership.

▼Relationships

Relevant to the view"Research Concepts - (1000)"

Nature	Mapping	Type	ID	Name
ChildOf	Allowed-with-Review	C	286	Incorrect User Management

Nature: ChildOf

Mapping: Allowed-with-Review

Type: Class

ID: 286

Name: Incorrect User Management

▼Memberships

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1212	Authorization Errors
MemberOf	Prohibited	C	1396	Comprehensive Categorization: Access Control

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1212

Name: Authorization Errors

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1396

Name: Comprehensive Categorization: Access Control

▼Tags

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	BS	BOSS-294	Not Language-Specific Weaknesses
MemberOf	Prohibited	BS	BOSS-332	Gain Privileges or Assume Identity (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-294

Name: Not Language-Specific Weaknesses

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-332

Name: Gain Privileges or Assume Identity (impact)

▼Relevant To View

Relevant to the view"Software Development - (699)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1212	Authorization Errors

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 1212

Name: Authorization Errors

▼Common Consequences

Scope	Likelihood	Impact	Note
Access Control	N/A	Gain Privileges or Assume Identity	N/A

Scope: Access Control

Likelihood: N/A

Impact: Gain Privileges or Assume Identity

Note:

N/A

▼Modes Of Introduction

Phase: Implementation

Note:

N/A

Phase: Operation

Note:

N/A

▼Applicable Platforms

Languages

Class: Not Language-Specific(Undetermined Prevalence)

▼Observed Examples

Reference	Description
CVE-1999-1193	Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.
CVE-2010-3716	Chain: drafted web request allows the creation of users with arbitrary group membership.
CVE-2008-5397	Chain: improper processing of configuration options causes users to contain unintended group memberships.
CVE-2007-6644	CMS does not prevent remote administrators from promoting other users to the administrator group, in violation of the intended security model.
CVE-2007-3260	Product assigns members to the root group, allowing escalation of privileges.
CVE-2002-0080	Chain: daemon does not properly clear groups before dropping privileges.

Reference: CVE-1999-1193

Description:

Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.

Reference: CVE-2010-3716

Description:

Chain: drafted web request allows the creation of users with arbitrary group membership.

Reference: CVE-2008-5397

Description:

Chain: improper processing of configuration options causes users to contain unintended group memberships.

Reference: CVE-2007-6644

Description:

CMS does not prevent remote administrators from promoting other users to the administrator group, in violation of the intended security model.

Reference: CVE-2007-3260

Description:

Product assigns members to the root group, allowing escalation of privileges.

Reference: CVE-2002-0080

Description:

Chain: daemon does not properly clear groups before dropping privileges.

▼Vulnerability Mapping Notes

Usage:Allowed

Reason:Acceptable-Use

Rationale:

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments:

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.