CWE-1267
Weakness AllowedPolicy Uses Obsolete Encoding
Abstraction: Base · Status: Draft
The product uses an encoding mechanism that is no longer trusted, i.e., an obsolete encoding, to implement access controls.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Content history
updated Applicable_Platforms, Demonstrative_Examples, Description, Modes_of_Introduction, Potential_Mitigations
updated Related_Attack_Patterns
updated Related_Attack_Patterns
updated Demonstrative_Examples
updated References, Relationships
updated Mapping_Notes
updated Demonstrative_Examples, Weakness_Ordinalities
updated Background_Details, Description
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
- Security Token Decoders should be reviewed for design inconsistency and common weaknesses.
- Access and programming flows should be tested in both pre-silicon and post-silicon testing.
CAPEC-121: Exploit Non-Production Interfaces
An adversary exploits a sample, demonstration, test, or debug interface that is unintentionally enabled on a production system, with the goal of gleaning information or leveraging functionality that would otherwise be unavailable.
CAPEC-681: Exploitation of Improperly Controlled Hardware Security Identifiers
An adversary takes advantage of missing or incorrectly configured security identifiers (e.g., tokens), which are used for access control within a System-on-Chip (SoC), to read/write data or execute a given action.