4. of Tampering II
Your code makes access control decisions all over the place, rather than with a security kernel:
|
Threat |
|
|
|
You’re checking roles and making decisions based on a fixed set of roles but haven’t considered that new roles may be added and your code doesn’t have a secure default behavior. As these checks are not centralized, you must go and touch multiple parts of the code base and forget to modify all the places where these checks have been implemented. |
|
CAPEC |
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs |
|
ASVS |
1.4.4: Ensure the use of a security kernel to manage access control |
|
CWE |
... |
