CVE-2024-13188

Account management defines and authorizes the exact privileges granted to each account or role.

Separation of duties constrains which privilege combinations may be assigned to any actor.

Enforces access restrictions on changes, including permission settings applied during installation or configuration.

Lifecycle management can encompass permission settings, yet the control is too broad to specifically mitigate incorrect defaults.

Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.

Hardened baselines and configuration management explicitly require correct default file permissions.

Secure SDLC practices include establishing secure defaults, but address only the development-phase portion of the weakness.

A.5.15 directly requires determining access needs, defining/enforcing topic-specific access control policy and rules (including need-to-know, privilege restrictions, segregation, formal authorization, role-based mapping, and consistency with classification), which stops most incorrect privilege assignments from being exploitable; the bounded remainder is incorrect assignments that arise from flawed implementation of those rules rather than from their absence.

A.5.18's provisioning, review, revocation and SoD rules (esp. a,b,c,f,i,j) directly stop most incorrect privilege assignments from being granted or persisting, with a bounded remainder in flawed implementation of the authorization step itself (see 5.9/5.15 dependency)