10. of Tampering II
An attacker can alter information in a data store because it has weak ACLs or includes a group that is equivalent to everyone (all Live ID holders).
The alternative text is that an attacker can alter information in a data store because it has weak/open permissions or includes a group that is equivalent to everyone (anyone with a Facebook account):
|
Threat |
|
|
|
The policy associated with your cloud object storage allows write access to any IAM role in the organization. |
|
CAPEC |
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs |
|
ASVS |
4.1.3: Ensure users or services only have the necessary privileges to perform the actions they need to do |
