Weakness (CWE)
CWE-277: Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-277
22 results · Clear filters · Feed
-
High 7.0
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows application…
-
High 7.8
Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbi…
-
High 7.2
Authenticated Arbitrary File Write Vulnerability in AOS 10 and AOS-8 Web-Based Management Interface
Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arb…
-
High 8.1
Coder's privilege escalation vulnerability could lead to a cross workspace compromise
Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a ses…
-
High 7.7
Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a p…
-
High 8.8
Improper Preservation of Permissions in xxl-job
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
-
High 8.8
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the …
-
High 8.4CVE-2024-34329 Public exploit
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch a…
-
High 7.5
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive informati…
-
High 8.8
Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Secu…
-
High 8.8
Firefox Android missed activation delay to prevent tapjacking
Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
-
High 7.4
This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Son…
-
High 7.4
This issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
-
High 7.4CVE-2024-27822 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to…
-
High 7.8
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This iss…
-
High 8.4
Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permi…
-
High 7.4
Insecure Inherited Permissions
Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230…
-
High 7.8
Denial of Service (DoS) vulnerability in SAP SQL Anywhere
SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be le…
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
High 7.3
Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insec…
-
High 8.8
Insecure Inherited Permissions in Apache Hadoop
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.