Skip to main content

Insufficient Granularity of Access Control

CVE-2024-43604

Medium
5.7/10

Summary

Outlook for Android Elevation of Privilege Vulnerability

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • LOW
  • HIGH
  • NONE

CWE-1220 - Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References

Advisory Timeline

  • Published