Skip to content
OpenAdvisories

Weakness (CWE)

CWE-269: Improper Privilege Management

Class Draft Mapping discouraged

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it (3 mitigations)

  1. Architecture and Design, Operation

    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design

    Follow the principle of least privilege when assigning access rights to entities in a software system.

  3. Architecture and Design

    Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

Source: MITRE CWE-269

All Critical High Medium Low Exploited only Public exploit

1,765 results · Clear filters · Feed

  • High 8.5
    CVE-2014-9193

    Innominate mGuard Improper Privilege Management

    Innominate mGuard with firmware before 7.6.6 and 8.x before 8.1.4 allows remote authenticated admins to obtain root privileges by changing a PPP configuration setting.

    Innominate mGuard
  • High 8.4
    CVE-2014-3499

    Privilege Escalation in Docker

    Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

    github.com/docker/docker Go
  • High 8.8
    CVE-2013-0643 Exploited EPSS 11%

    The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and …

    KEV Sep 17, 2024
  • High 7.8
    CVE-2002-0367 Exploited Public exploit

    smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to oth…

    KEV Mar 3, 2022
  • High 8.4
    CVE-1999-0084

    Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID …