Weakness (CWE)
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-276
1,058 results · Feed
-
High 7.3
Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege …
-
Critical 9.8
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, …
-
High 7.8
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.…
-
High 7.8
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5…
-
Critical 9.8
An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sono…
-
Critical 9.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…
-
High 7.8
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma…
-
Critical 9.8
A permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, m…
-
Critical 9.8
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macO…
-
High 7.8
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in …
-
Medium 6.3
WatchGuard Terminal Services Agent Local Privilege Escalation via Non-Standard Installation Directory
The WatchGuard Terminal Services Agent on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
-
Medium 6.3
WatchGuard Mobile VPN with SSL Local Privilege Escalation via Non-Standard Installation Directory
The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.
-
Critical 9.8
HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafte…
-
Low 3.8
AWS CDK CodePipeline: trusted entities are too broad
### Summary The [AWS Cloud Development Kit (CDK)](https://aws.amazon.com/cdk/) is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during …
-
Medium 5.9
Libcontainer is affected by capabilities elevation
libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all c…
-
High 7.8
When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not…
-
Critical 9.8
PipeCD Vulnerable to Privilege Escalation
Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sono…
-
Medium 5.5
Task Hijacking in hamza417/inure
A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive inf…
-
Medium 4.3
In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) con…
-
High 7.8
Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1…
-
High 7.8
Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Pe…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links…
-
Medium 6.2
Vulnerability of improper access permission in the HDC module Impact: Successful exploitation of this vulnerability may…
-
High 8.4
Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw…
-
Critical 9.8
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Jour…
-
Medium 5.5
Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Lo…
-
Medium 6.7
Incorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authent…
-
Medium 6.7
Incorrect default permissions for some Intel(R) GPA and Intel(R) GPA Framework software installers may allow an authent…
-
Critical 9.8
MaysWind ezBookkeeping has Improper Privilege Management
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.
-
High 7.8
An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.
-
High 7.3
Incorrect default permissions in the AMD Integrated Management Technology (AIM-T) Manageability Service installation di…
-
Critical 9.8CVE-2024-55215 Public exploit
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization inte…
-
High 7.8
Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the install…
-
Critical 9.7
Dumb Drop has an arbitrary file overwrite and path traversal for root shell
Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritt…
-
Medium 4.4
The Snowflake Connector for Python uses insecure cache files permissions
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux …
-
Medium 5.0
Snowflake Connector for .NET has weak temporary files permissions
snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which files downloaded from stages are temporarily placed in a world-readable local directory, making them …
-
Medium 4.4
Snowflake JDBC uses insecure temporary credential cache file permissions
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching…
-
Low 3.3
MicroWorld eScan Antivirus Quarantine Microworld default permission
A vulnerability was found in MicroWorld eScan Antivirus 7.0.32 on Linux. It has been declared as problematic. This vulnerability affects unknown code of the file /var/Microworld/ of the component Quarantine Handler. The manipulation leads to incorrect default…