Weakness (CWE)
CWE-268: Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
How to prevent it (3 mitigations)
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design, Operation
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE-268
11 results · Clear filters · Feed
-
Medium 5.9
IBM WebSphere Application Server Liberty bypass security
IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration
-
Medium 5.1
Cisco Unified Communications Products Privilege Escalation Vulnerability
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability is due to excessive permissions that have been …
-
Medium 6.0
Harden-Runner Evasion of 'disable-sudo' policy
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. Versions from 0.12.0 to before 2.12.0 are vulnerable to `disable-sudo` bypass. Harden-Runner includes a policy option `disable-sudo` to prevent the GitHub Actions runne…
-
Medium 6.5
silverstripe/framework Privilege Escalation Risk in Member Edit form
A member with the permission `EDIT_PERMISSIONS` and access to the "Security" section is able to re-assign themselves (or another member) to `ADMIN` level. CMS Fields for the member are constructed using DirectGroups instead of Groups relation which results in…
-
Medium 6.5
Privilege Chaining in GitLab
A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.
-
Medium 6.5
Privilege Chaining in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which ma…
-
Medium 4.9
A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on th…
-
Medium 6.7
A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster…
-
Medium 5.3
Privilege Chaining in cockpit-hq/cockpit
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
-
Medium 6.3
Cross-Site Request Forgery (CSRF) in area17/twill
twill is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.5CVE-2019-3844 Public exploit
It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of…