Weakness (CWE)
CWE-250: Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
How to prevent it (7 mitigations)
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
-
Architecture and Design
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
-
Architecture and Design
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
-
Implementation
Perform extensive input validation for any privileged code that must be exposed to the user and reject anything that does not fit your strict requirements.
-
Implementation
When dropping privileges, ensure that they have been dropped successfully to avoid CWE-273. As protection mechanisms in the environment get stronger, privilege-dropping calls may fail even if it seems like they would always succeed.
-
Implementation
If circumstances force you to run with extra privileges, then determine the minimum access level necessary. First identify the different permissions that the software and its users will need to perform their actions, such as file read and write permissions, network socket permissions, and so forth. Then explicitly allow those actions while denying all else [REF-76]. Perform extensive input validation and canonicalization to minimize the chances of introducing a separate vulnerability. This mitigation is much more prone to error than dropping the privileges in the first place.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-250
113 results · Clear filters · Feed
-
Medium 6.7
Lack of privileges separation
The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.
-
Medium 6.6
Submariner-operator: rbac permissions can allow for the spread of node compromises
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and pote…
-
Medium 6.7
Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A…
-
Medium 4.7
Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG…
-
Medium 6.5
A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websi…
-
Medium 6.8
A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary bei…
-
Medium 6.5
Leverage the kruise-daemon pod to list all secrets in the entire cluster
Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of the node that kruise-daemon run can leverage the kruise-daemo…
-
Medium 5.9
IBM CICS TX privilege escalation
IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 266163.
-
Medium 5.4
Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere
SnapCenter Plugin for VMware vSphere versions 4.6 prior to 4.9 are susceptible to a vulnerability which may allow authenticated unprivileged users to modify email and snapshot name settings within the VMware vSphere user interface.
-
Medium 5.5
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an …
-
Medium 6.7
Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. A low privilege local attacker could …
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions
-
Medium 6.0
A vulnerability in Cisco BroadWorks could allow an authenticated, local attacker to elevate privileges to the root user…
-
Medium 4.4
Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions by disabling pro…
-
Medium 6.4
Privilege Escalation Vulnerability by wrong chmod param
super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurate default xray permissions. Note: this vulnerability only affects Linux and Mac OS systems. Users sh…
-
Medium 6.8
2.2.6 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by exploiting a system level service. An attacker could leverage this vulnerability to escalate privileges on a device and/or install malicious…
-
Medium 4.8
Web server runs as root
The Bosch Ethernet switch PRA-ES8P2S with software version 1.01.05 runs its web server with root privilege. In combination with CVE-2022-23534 this could give an attacker root access to the switch.
-
Medium 5.1
Cisco IOS XE Software Tool Command Language Privilege Escalation Vulnerability
A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due to insufficient input validation of da…
-
Medium 5.5
Junos OS: mosquitto Local Privilege Escalation vulnerability in SUID binaries
A sensitive information disclosure vulnerability in the mosquitto message broker of Juniper Networks Junos OS may allow a locally authenticated user with shell access the ability to read portions of sensitive files, such as the master.passwd file. Since mosqu…
-
Medium 5.5
Junos OS: ethtraceroute Local Privilege Escalation vulnerability in SUID binaries
A local privilege escalation vulnerability in ethtraceroute of Juniper Networks Junos OS may allow a locally authenticated user with shell access to escalate privileges and write to the local filesystem as root. ethtraceroute is shipped with setuid permission…
-
Medium 5.8
Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any h…
-
Medium 6.7CVE-2020-14386 Public exploit
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from un…
-
Medium 6.8
RVD#1495: Universal Robots URCaps execute with unbounded privileges
Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated in our video. In our …
-
Medium 4.2
Unquoted service executable path
Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
-
Medium 6.6
In EzMaster before 5.2.11 docker containers were executed with advanced privileges by default
The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)
-
Medium 4.7
rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `…
-
Medium 6.4
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a loca…
-
Medium 4.4
It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When…
-
Medium 5.5
A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in E…
-
Medium 6.5
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or …
-
Medium 6.3
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pat…
-
Medium 5.3
Podman Elevated Container Privileges
It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
-
Medium —
Tomcat uses trusted privileges when processing web.xml file
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.