Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
411 results · Clear filters · Feed
-
Medium 5.5
InstallShield Symlink Vulnerability Affecting Suite Project Setups
A vulnerability has been reported in Suite Setups built with versions prior to InstallShield 2023 R2. This vulnerability may allow locally authenticated users to cause a Denial of Service (DoS) condition when handling move operations on local, temporary folde…
-
Medium 5.3
WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
-
Medium 5.5
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
-
Medium 4.4
European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permission
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permiss…
-
Medium 6.7
Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop…
-
Medium 6.6
File and Directory Permission Vulnerability in Hitachi Tuning Manager
Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write specific files.This issue affects Hitachi Tuning Manager: before 8.8.5-04.
-
Medium 5.5
Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local at…
-
Medium 5.5
Executable files writable by low-privileged users in Omron Sysmac Studio
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
-
Medium 5.3
Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerab…
-
Medium 5.5
In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due …
-
Medium 4.3
Apache Superset: Unnecessary read permissions within the Gamma role
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to re…
-
Medium 4.7
CSZCMS File Manager Page templates permission
A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched…
-
Medium 4.0
PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in …
-
Medium 6.2
Liteos-A has a incorrect default permissions vulnerability
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.
-
Medium 6.5
Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach th…
-
Medium 6.7
Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authent…
-
Medium 6.7
Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated …
-
Medium 6.5
Samba: smb clients can truncate files with read-only permissions
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …
-
Medium 6.7
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models cou…
-
Medium 6.7
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that w…
-
Medium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber…
-
Medium 4.8
Cri-o: security regression of cve-2022-27652
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was pr…
-
Medium 6.1
Insecure Default Permissions in Wing FTP Server <= 7.2.0
Insecure default permissions in Wing FTP Server (Admin Web Client) allows for privilege escalation.This issue affects Wing FTP Server: <= 7.2.0.
-
Medium 5.7
Improper securing of log directory may allow a denial of service
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.
-
Medium 5.3
Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. A low-privileged local attacker …
-
Medium 6.7
Incorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentiall…
-
Medium 6.7
Incorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authe…
-
Medium 6.7
Incorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated …
-
Medium 4.4
Incorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileg…
-
Medium 6.7
Incorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before versi…
-
Medium 5.9
Code Execution through overwriting project file on zenon engineering studio system
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing the…
-
Medium 6.6
File and Directory Permission Vulnerability in Hitachi Command Suite
Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hi…
-
Medium 6.1
Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to man…
-
Medium 6.8
An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0…
-
Medium 6.7
The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version V2.70(AAHH.3) and the GS1900-8HP firmware…
-
Medium 4.3
Jenkins AppSpider Plugin missing permission check
A missing permission check in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
-
Medium 4.3
Jenkins SAML Single Sign On(SSO) Plugin missing permission checks
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
-
Medium 5.5
In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure …
-
Medium 6.7
Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow a…
-
Medium 6.7
Incorrect default permissions in the software installer for Intel(R) Unite(R) Client software for Windows before versio…