Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,060 results · Feed
-
Medium 5.5
In applySyncTransaction of WindowOrganizer.java, a missing permission check could lead to local information disclosure …
-
High 7.8
In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local es…
-
Medium 6.7
Incorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow a…
-
Medium 6.7
Incorrect default permissions in the software installer for Intel(R) Unite(R) Client software for Windows before versio…
-
Medium 6.7
Incorrect default permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated…
-
Medium 6.7
Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an a…
-
Medium 6.7
Incorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user t…
-
Medium 6.7
Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 be…
-
Medium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 1…
-
Critical 9.9
Rancher Webhook is misconfigured during upgrade process
Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead to the misconfiguration of the Webhook. This component enforces validation rules and security checks…
-
Critical 9.8
An issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions…
-
High 7.1
NGINX Management Suite vulnerability
NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager. Note: Software versions which have reached End of Technical Suppo…
-
High 7.5
Download Manager Pro < 6.3.0 - Unauthenticated Sensitive Information Disclosure
The Download Manager WordPress plugin before 6.3.0 leaks master key information without the need for a password, allowing attackers to download arbitrary password-protected package files.
-
High 8.8
In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to e…
-
High 7.0
A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.
-
Medium 6.5CVE-2023-27035 Public exploit
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio a…
-
High 7.3
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations…
-
Medium 6.4
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the …
-
High 7.8
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Serv…
-
High 8.7
A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated adminis…
-
High 7.8
Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.
-
Medium 5.3
PowerJob vulnerable to Insecure Permissions
PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.
-
High 7.8
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to t…
-
High 7.8
Junos OS Evolved: Local low-privileged user with shell access can execute CLI commands as root
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged local attacker with shell access to modify existing files or execute commands as root. The issue is caused by improper file and directory permissions o…
-
High 7.1
An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive …
-
High 8.8
An issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal syst…
-
Critical 9.8CVE-2023-26918 Public exploit
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan…
-
High 7.0
Dell Trusted Device Agent, versions prior to 5.3.0, contain(s) an improper installation permissions vulnerability. An u…
-
High 7.8
Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. A low-privileged local at…
-
High 8.8
Fluent Fluentd and Fluent-ui use default password
An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default password.
-
High 8.8CVE-2023-25355 Public exploit
CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. A user who has the ability to run com…
-
Medium 5.5
tripleo-ansible may disclose important configuration details from an OpenStack deployment
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. T…
-
Medium 5.5
tripleo-ansible may disclose important configuration details from an OpenStack deployment
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, l…
-
Medium 4.4
cilium-agent container can access the host via `hostPath` mount
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in …
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
-
Medium 5.3
Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
-
Unscored —
An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to…
-
Medium 6.0
Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. A local malicious user could pot…
-
Medium 6.6
File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center
Incorrect Default Permissions vulnerability in Hitachi Automation Director on Linux, Hitachi Infrastructure Analytics Advisor on Linux (Hitachi Infrastructure Analytics Advisor, Analytics probe server components), Hitachi Ops Center Automator on Linux, Hitach…
-
High 7.3
Directory Permission Vulnerability in Hitachi Ops Center Analyzer
Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to read and write specific files.This issue affects Hitachi Ops Center Analyzer: from 10.9.0-00 before …