CWE-669: Incorrect Resource Transfer Between Spheres
| Abstraction | Structure | Status |
|---|
| None | Simple | Draft |
Description
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
| Nature | ID | View ID | Name |
|---|
| ChildOf | CWE-664 | 1000 | Improper Control of a Resource Through its Lifetime |
Background Details
A “control sphere” is a set of resources and behaviors that are accessible to a single actor, or a group of actors. A product’s security model will typically define multiple spheres, possibly implicitly. For example, a server might define one sphere for “administrators” who can create new user accounts with subdirectories under /home/server/, and a second sphere might cover the set of users who can create or delete files within their own subdirectories. A third sphere might be “users who are authenticated to the operating system on which the product is installed.” Each sphere has different sets of actors and allowable behaviors.
Modes of Introduction
| Phase | Note |
|---|
| Architecture and Design | - |
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
| Operation | - |
Common Consequences
| Scope | Impact | Note |
|---|
| Confidentiality, Integrity | Read Application Data, Modify Application Data, Unexpected State | |