CWE-128

GPTKB entity

Statements (36)
Predicate Object
gptkbp:instance_of gptkb:Common_Weakness_Enumeration
gptkbp:category Access Control Issues
gptkbp:consequences Data breaches, unauthorized data modification.
gptkbp:description The software assigns permissions to a resource in a way that allows unauthorized access.
gptkbp:difficulty_levels gptkb:High
gptkbp:example A file upload feature allows users to overwrite sensitive files.
A misconfigured cloud storage bucket allows public access.
A web application that allows users to access files without proper permission checks.
A user can access admin functions without being an admin.
gptkbp:has_weakness gptkb:CWE-284
CWE-269
https://www.w3.org/2000/01/rdf-schema#label CWE-128
gptkbp:impact Unauthorized access to critical resources.
gptkbp:is_referenced_in gptkb:CWE-200
gptkb:CWE-22
gptkb:CWE-276
gptkb:CWE-284
gptkb:CWE-73
gptkb:SANS_Top_25
gptkb:NIST_SP_800-53
gptkb:ISO/_IEC_27001
gptkb:OWASP_Top_Ten
CWE-732
CWE-269
gptkbp:name Incorrect Permission Assignment for Critical Resource
gptkbp:prevention User role management.
Regular security audits.
Implement proper access control mechanisms.
Least privilege principle.
gptkbp:provides_support_for Web applications
Mobile applications
Desktop applications
gptkbp:related_to gptkb:CWE-276
CWE-732
gptkbp:bfsParent gptkb:CWE-74
gptkbp:bfsLayer 8