The description above is MITRE’s definition of CWE-285 in CWE 4.20, a class-level weakness.
Common consequences MITRE lists
- Confidentiality: Read Application Data; Read Files or Directories
- Integrity: Modify Application Data; Modify Files or Directories
- Access Control: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
Closest guides
These guides cover the nearest controls and techniques; use them with the references below.
Keep retrieval inside the user’s data boundary
Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
Review infrastructure changes as access changes
Inspect the effective permissions, exposure, sensitive state, and recovery implications of a proposed infrastructure change.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.
Practice
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-285.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.