Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
411 results · Clear filters · Feed
-
Medium 6.8
inn: %post calls user owned file allowing local privilege escalation to root
A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root. This issue affects:…
-
Medium 5.3
Drupal Core Access bypass vulnerability
Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. A…
-
Medium 4.3
Liferay Portal and Liferay DXP Fails to Check Permissions
The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinitionResourceImpl.getSiteDataDefinitionByContentTypeByDataDefinitionKey, which allows remote authenticated users to view…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow con…
-
Medium 5.5
A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, tha…
-
Medium 6.3
Privilege escalation in RBAC system
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create ano…
-
Medium 5.5
A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow con…
-
Medium 5.3
Incorrect Default Permissions in JetBrains Kotlin
In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
-
Medium 6.5
Apache DolphinScheduler (incubating) Permission vulnerability
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
-
Medium 6.4
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerabi…
-
Medium 4.9
Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer deta…
-
Medium 5.5
A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundatio…
-
Medium 6.7
Local privilege elevation in Composer-Setup for Windows
In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local attacker may be able to exploit the following scenarios. 1. A local regular user may modify the existing `C:\ProgramData\ComposerSetup\bin\comp…
-
Medium 5.3
Silverstripe has Incorrect Default Permissions
SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete prot…
-
Medium 5.3
Problematic permissions in hylafax+ packaging allow escalation from uucp to other users
A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 …
-
Medium 6.5
An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and ot…
-
Medium 5.4
Dolibarr Stored Cross-site Scripting
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
-
Medium 5.3
Improper permission checks in Jenkins Copy Artifact Plugin
Jenkins Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks, allowing attackers to copy artifacts from jobs they have no permission to access.
-
Medium 4.9
Get-task-allow entitlement via BDLDaemon on macOS
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
-
Medium 4.0
libzypp stores cookies world readable
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: …
-
Medium 4.0
"easy" permission profile allows everyone execute dumpcap and read all network traffic
The permission package in SUSE Linux Enterprise Server allowed all local users to run dumpcap in the "easy" permission profile and sniff network traffic. This issue affects: SUSE Linux Enterprise Server permissions versions starting from 85c83fef7e017f8ab7f86…
-
Medium 5.4
Jenkins WebSphere Deployer Plugin missing permission check
A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system.
-
Medium 4.3
Missing permission check in Jenkins Build Failure Analyzer Plugin
A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
-
Medium 5.4
Missing permission check in Jenkins Gerrit Trigger Plugin
A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file …
-
Medium 5.3
Information disclosure in the Contao backend
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
-
Medium 5.3
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly…
-
Medium 6.5
Django allows unintended model editing
Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with …
-
Medium 6.2
Incorrect Default Permissions in keyring
Python keyring has insecure permissions on new databases allowing world-readable files to be created
-
Medium 4.3
Moodle default permissions too permissive
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
-
Medium 4.3
Jenkins Global Post Script Plugin missing permission check
A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
-
Medium 4.3
Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration
A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins Libvirt Slaves Plugin vlnerable to Incorrect Default Permissions
A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in …
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
-
Medium 6.5
Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization
A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credenti…
-
Medium 4.3
Jenkins Deploy WebLogic Plugin missing permission check
A missing permission check in Jenkins Deploy WebLogic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials, or determine whether a file or directory with an attacker-specified path e…
-
Medium 6.5
Jenkins Dynatrace Plugin contains Incorrect Default Permissions
A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
-
Medium 5.1
squid: /usr/sbin/pinger packaged with wrong permission
The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker tha…
-
Medium 5.1
nfs-utils: root-owned files stored in insecure /var/lib/nfs directory
The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains …
-
Medium 4.7
Beego has a file creation race condition
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
-
Medium 6.1
A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creatio…