Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,060 results · Feed
-
High 7.8
In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local…
-
High 7.8
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions …
-
High 7.5
In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an…
-
High 8.8
An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows …
-
Medium 6.5
Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-leve…
-
High 8.8
An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticate…
-
Medium 6.5
Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.
-
Critical 9.8
AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.
-
High 8.1
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users …
-
High 7.8
In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missi…
-
High 7.8
In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. …
-
High 7.8
In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permission…
-
Medium 5.5
A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration,…
-
High 7.8
In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypa…
-
Medium 5.5
A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configur…
-
High 7.8
By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical …
-
High 7.8
By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission…
-
High 7.8
By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical fi…
-
High 7.8
By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical fil…
-
High 7.8
By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical fil…
-
Low 3.7
HCL Connections is vulnerable to a broken access control vulnerability
HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenarios.
-
Medium 6.7
Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated use…
-
Medium 6.7
Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an auth…
-
Medium 6.7
Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may…
-
High 8.0
Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin
Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous buil…
-
High 7.2
Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) S…
-
Medium 5.5
In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a thi…
-
High 7.8
In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission…
-
High 7.8
In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlock…
-
High 7.8
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a l…
-
High 7.8
In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone du…
-
High 7.8
In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a l…
-
High 7.0
grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images
grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.
-
High 7.3
Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve…
-
High 7.3
Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve p…
-
High 7.3
Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achie…
-
High 7.3
Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker t…
-
High 7.3
Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow…
-
High 7.3
Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM…
-
High 7.3
Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege es…