CWE-638: Not Using Complete Mediation
The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
Last updated
Overview
CWE-638 (Not Using Complete Mediation) is a class-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
1 recorded CVEs are caused by CWE-638 (Not Using Complete Mediation). The highest-severity and most recent are shown first.
Common consequences
What can happen when CWE-638 is exploited.
Gain Privileges or Assume Identity, Execute Unauthorized Code or Commands, Bypass Protection Mechanism, Read Application Data, Other
Affects: Integrity, Confidentiality, Availability, Access Control, Other
A user might retain access to a critical resource even after privileges have been revoked, possibly allowing access to privileged functionality or sensitive information, depending on the role of the resource.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.