Weakness (CWE)
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE-266
1,331 results · Feed
-
Unscored —
An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw…
-
High 7.8
ConfD CLI Secure Shell Server Privilege Escalation Vulnerability
A vulnerability in ConfD could allow an authenticated, local attacker to execute arbitrary commands at the level of the account under which ConfD is running, which is commonly root. To exploit this vulnerability, an attacker must have a valid account on an af…
-
Unscored —
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attack…
-
Unscored —
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attack…
-
Unscored —
An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access …
-
Unscored —
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a cont…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in R…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shi…
-
Unscored —
An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-m…
-
Medium 6.5
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerabilities
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sen…
-
Medium 6.5
Cisco Identity Services Engine Sensitive Information Disclosure Vulnerabilities
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sen…
-
Medium 5.1
Unprivileged overlay + shiftfs read access
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unp…
-
Medium 4.3
Cisco DNA Center Privilege Escalation Vulnerability
A vulnerability in the user management roles of Cisco DNA Center could allow an authenticated, remote attacker to execute unauthorized commands on an affected device. The vulnerability is due to improper enforcement of actions for assigned user roles. An atta…
-
Medium 4.3
A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to …
-
Medium 4.4
Cisco Identity Services Engine Privilege Escalation Vulnerability
A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a val…
-
Medium 6.8
Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remot…
-
High 7.7
Improper privilege assignment vulnerability in the installer component of MACC
Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine…
-
Unscored —
Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is giv…
-
High 8.8
Privilege Escalation Flaw in Elasticsearch
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to genera…
-
High 7.8
Incorrect privilege assignment allowing non-admin users to upload config files
Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the sys…
-
High 7.0
Global Protect Agent: Incorrect privilege assignment allows local privilege escalation
An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platform allows a local authenticated user to gain root privileges on the system. This issue affects Palo A…
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting…
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affect…
-
High 8.8
Improper Privilege Management in Elasticsearch
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being g…
-
High 7.0
A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification …
-
High 7.0
A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an …
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An …
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacke…
-
High 7.0
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (mais…
-
High 7.0
It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3…
-
Unscored —
A vulnerability has been identified in SINEMA Server (All versions < V14.0 SP2 Update 1). Incorrect session validation …
-
High 7.5
A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc …
-
Medium 4.9
kubelet-started container uid changes to root after first restart or if image is already pulled to the node
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will…
-
High 8.8
Incorrect Privilege Assignment in Jenkins Script Security Plugin
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
-
Medium 5.5
Incorrect privilege assignment in the app permission update API of the Bosch Smart Home Controller (SHC)
A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerabili…
-
High 8.0
Incorrect privilege assignment in the app pairing mechanism of the Bosch Smart Home Controller (SHC)
A potential incorrect privilege assignment vulnerability exists in the app pairing mechanism of the Bosch Smart Home Controller (SHC) before 9.8.905 that may result in elevated privileges of the adversary's choosing. In order to exploit the vulnerability, the…
-
Medium 6.4
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a loca…
-
Medium 4.5CVE-2019-3843 Public exploit
It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be all…