Editing Confused deputy problem (section)

{{Short description|Computer security vulnerability}}
In [[information security]], a '''confused deputy''' is a [[computer program]] that is tricked by another program (with fewer privileges or less rights) into misusing its authority on the system. It is a specific type of [[privilege escalation]].<ref>{{Cite journal|last=Wu|first=Jianliang|last2=Cui|first2=Tingting|last3=Ban|first3=Tao|last4=Guo|first4=Shanqing|last5=Cui|first5=Lizhen|date=2015-09-10|title=PaddyFrog: systematically detecting confused deputy vulnerability in Android applications: PaddyFrog: systematically detecting confused deputy vulnerability in Android applications|url=https://onlinelibrary.wiley.com/doi/10.1002/sec.1179|journal=Security and Communication Networks|language=en|volume=8|issue=13|pages=2338–2349|doi=10.1002/sec.1179|url-access=subscription}}</ref> The '''confused deputy problem''' is often cited as an example of why [[capability-based security]] is important.

[[Capability-based security|Capability systems]] protect against the confused deputy problem, whereas [[access-control list]]–based systems do not.<ref>{{cite web|url=http://waterken.sourceforge.net/aclsdont/|title=ACLs don't|work=sourceforge.net}}</ref>