auren-research/cyber-sec huggingface dataset:
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Resultant
This is resultant from errors that prevent the permissions from being preserved.

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Confidentiality
Integrity
Read Application Data
Modify Application Data

CVE-2002-2323
Incorrect ACLs used when restoring backups from directories that use symbolic links.
https://www.cve.org/CVERecord?id=CVE-2002-2323

CVE-2001-1515
Automatic modification of permissions inherited from another file system.
https://www.cve.org/CVERecord?id=CVE-2001-1515

CVE-2005-1920
Permissions on backup file are created with defaults, possibly less secure than original file.
https://www.cve.org/CVERecord?id=CVE-2005-1920

CVE-2001-0195
File is made world-readable when being cloned.
https://www.cve.org/CVERecord?id=CVE-2001-0195

Permission preservation failure

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings, Weakness_Ordinalities

CWE Content Team
MITRE
2009-05-27
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships

Permission Preservation Failure
The product does not properly manage a user within its environment.
Users can be assigned to the wrong group (class) of permissions resulting in unintended access rights to sensitive objects.

Primary

Resultant

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Other
Varies by Context

CVE-2022-36109
Containerization product does not record a user's supplementary group ID, allowing bypass of group restrictions.
https://www.cve.org/CVERecord?id=CVE-2022-36109

CVE-1999-1193
Operating system assigns user to privileged wheel group, allowing the user to gain root privileges.
https://www.cve.org/CVERecord?id=CVE-1999-1193

User management errors

Allowed-with-Review
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit

The relationships between privileges, permissions, and actors (e.g. users and groups) need further refinement within the Research view. One complication is that these concepts apply to two different pillars, related to control of resources (CWE-664) and protection mechanism failures (CWE-693).
This item needs more work. Possible sub-categories include: user in wrong group, and user with insecure profile or "configuration". It also might be better expressed as a category than a weakness.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-03-29
updated Applicable_Platforms, Maintenance_Notes, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

User Management Issues
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

Prohibited
This CWE has been deprecated.
See description and name for possible suggestions of other CWEs to consider.

CLASP
2006-07-19
Draft 3
2006-07-19

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-05-27
updated Demonstrative_Examples

CWE Content Team
MITRE
2009-10-29
updated Observed_Examples

CWE Content Team
MITRE
2010-09-27
updated Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Demonstrative_Examples, Relationships

CWE Content Team
MITRE
2013-06-23
Critical
CWE-247 and CWE-292 deprecated and merged into CWE-350 to address duplicates.

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type

CWE Content Team
MITRE
2014-07-30
updated Taxonomy_Mappings

CWE Content Team
MITRE
2021-03-15
updated Likelihood_of_Exploit, Taxonomy_Mappings

CWE Content Team
MITRE
2021-07-20
updated Name

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

Trusting Self-reported DNS Name
DEPRECATED (Duplicate): Trusting Self-reported DNS Name
The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
This incorrect implementation may allow authentication to be bypassed.

Primary

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Bypass Protection Mechanism

CVE-2003-0750
Conditional should have been an 'or' not an 'and'.
https://www.cve.org/CVERecord?id=CVE-2003-0750

Authentication Logic Error

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2009-05-27
updated Description, Name

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Authentication Logic Error
Improper Implementation of Authentication Algorithm
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Bypass Protection Mechanism

CVE-2002-1374
The provided password is only compared against the first character of the real password.
https://www.cve.org/CVERecord?id=CVE-2002-1374

CVE-2000-0979
The password is not properly checked, which allows remote attackers to bypass access controls by sending a 1-byte password that matches the first character of the real password.
https://www.cve.org/CVERecord?id=CVE-2000-0979

CVE-2001-0088
Chain: Forum software does not properly initialize an array, which inadvertently sets the password to a single character, allowing remote attackers to easily guess the password and gain administrative privileges.
https://www.cve.org/CVERecord?id=CVE-2001-0088

Authentication Bypass by Primary Weakness

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Most "authentication bypass" errors are resultant, not primary.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2008-11-24
updated Observed_Examples

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities
The product stores sensitive information in cleartext in the registry.
Attackers can read the information by accessing the registry key. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Primary

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Confidentiality
Read Application Data

CVE-2005-2227
Cleartext passwords in registry key.
https://www.cve.org/CVERecord?id=CVE-2005-2227

Plaintext Storage in Registry

SFP23
Exposed Data

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Description, Name, Observed_Examples, Potential_Mitigations, Terminology_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Plaintext Storage in Registry
Plaintext Storage in the Registry
The product stores sensitive information in cleartext within the GUI.
An attacker can often obtain data from a GUI, even if hidden, by using an API to directly access GUI objects such as windows and menus. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Primary

Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Confidentiality
Read Memory
Read Application Data

CVE-2002-1848
Unencrypted passwords stored in GUI dialog may allow local users to access the passwords.
https://www.cve.org/CVERecord?id=CVE-2002-1848

Plaintext Storage in GUI

SFP23
Exposed Data

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Applicable_Platforms, Description, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Description, Name, Potential_Mitigations, Terminology_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Plaintext Storage in GUI
The product stores sensitive information in cleartext in an executable.
Attackers can reverse engineer binary code to obtain secret data. This is especially easy when the cleartext is plain ASCII. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

Primary

Implementation

Confidentiality
Read Application Data

CVE-2005-1794
Product stores RSA private key in a DLL and uses it to sign a certificate, allowing spoofing of servers and Adversary-in-the-Middle (AITM) attacks.
https://www.cve.org/CVERecord?id=CVE-2005-1794

CVE-2001-1527
administration passwords in cleartext in executable
https://www.cve.org/CVERecord?id=CVE-2001-1527

Plaintext Storage in Executable

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Different people use "cleartext" and "plaintext" to mean the same thing: the lack of encryption. However, within cryptography, these have more precise meanings. Plaintext is the information just before it is fed into a cryptographic algorithm, including already-encrypted text. Cleartext is any information that is unencrypted, although it might be in an encoded form that is not easily human-readable (such as base64 encoding).

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2013-07-17
updated Applicable_Platforms, Description, Name, Potential_Mitigations, Terminology_Notes

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Observed_Examples, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2021-07-20
updated Observed_Examples

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Modes_of_Introduction, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities

Plaintext Storage in Executable
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Primary

Implementation

Access Control
Integrity
Bypass Protection Mechanism
Modify Application Data
An attacker could package untrusted data with trusted data to bypass protection mechanisms to gain access to and possibly modify sensitive data.

CVE-2002-0018
Does not verify that trusted entity is authoritative for all entities in its response.
https://www.cve.org/CVERecord?id=CVE-2002-0018

CVE-2006-5462
use of extra data in a signature allows certificate signature forging
https://www.cve.org/CVERecord?id=CVE-2006-5462

Untrusted Data Appended with Trusted Data

ENV01-J
Place all security-sensitive code in a single JAR and sign and seal it

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2012-05-11
updated Common_Consequences, Related_Attack_Patterns, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2019-01-03
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Observed_Examples, Relationships

CWE Content Team
MITRE
2022-04-28
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Modes_of_Introduction, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes, Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Relationships, Weakness_Ordinalities

Untrusted Data Appended with Trusted Data
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

Primary

Resultant

Implementation

Other
Other

CVE-2005-2260
Browser user interface does not distinguish between user-initiated and synthetic events.
https://www.cve.org/CVERecord?id=CVE-2005-2260

CVE-2005-2801
Product does not compare all required data in two separate elements, causing it to think they are the same, leading to loss of ACLs. Similar to Same Name error.
https://www.cve.org/CVERecord?id=CVE-2005-2801

Insufficient Type Distinction

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Overlaps others, e.g. Multiple Interpretation Errors.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Relationship_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Applicable_Platforms

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities