CWE-708: Incorrect Ownership Assignment

Base

The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

This may allow the resource to be manipulated by actors outside of the intended control sphere.

Consequences

Confidentiality, Integrity: Read Application Data, Modify Application Data

How to prevent it

Policy: Periodically review the privileges and their owners.

Recent advisories

GHSA-gfgr-6hrj-85ww — Juju affected by timing ownership claim attack on new external back-end secrets

All advisories for CWE-708

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor