CWE-279: Incorrect Execution-Assigned Permissions

VariantDraft

While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple

Applicable To

Languages
Not Language-Specific
Platforms

Frequently Asked Questions

What is CWE-279: Incorrect Execution-Assigned Permissions?+

CWE-279: Incorrect Execution-Assigned Permissions is a Common Weakness Enumeration (CWE) entry maintained by MITRE. While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

What are the security consequences of Incorrect Execution-Assigned Permissions?+

If exploited, CWE-279 (Incorrect Execution-Assigned Permissions) it can compromise Confidentiality and Integrity, leading to outcomes such as Read Application Data and Modify Application Data.

Which programming languages are affected by Incorrect Execution-Assigned Permissions?+

CWE-279 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Incorrect Execution-Assigned Permissions?+

MITRE documents real CVEs mapped to CWE-279, including CVE-2002-0265, CVE-2003-0876 and CVE-2002-1694. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-279 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More