Weakness (CWE)
CWE-277: Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-277
75 results · Feed
-
High 8.8
Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Secu…
-
High 8.8
Firefox Android missed activation delay to prevent tapjacking
Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.
-
Medium 6.3
Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arb…
-
High 7.4
This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Son…
-
Medium 6.7
Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated us…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user t…
-
High 7.4
This issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS…
-
High 7.4CVE-2024-27822 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to…
-
High 7.8
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This iss…
-
High 8.4
Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges…
-
High 7.8
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permi…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated u…
-
Medium 6.7
Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software…
-
Medium 4.1
Overly Permissive Access Policy
The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.
-
Medium 6.7
Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may al…
-
Medium 6.7
Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticat…
-
Medium 6.7
Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow a…
-
High 7.4
Insecure Inherited Permissions
Insecure Inherited Permissions vulnerability in Schweitzer Engineering Laboratories SEL-5033 AcSELerator RTAC Software on Windows allows Leveraging/Manipulating Configuration File Search Paths. See Instruction Manual Appendix A [Cybersecurity] tag dated 20230…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user t…
-
High 7.8
Denial of Service (DoS) vulnerability in SAP SQL Anywhere
SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be le…
-
Medium 6.7
Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow…
-
Medium 6.7
Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticate…
-
Medium 6.7
Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10…
-
Medium 6.7
Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authentic…
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
Medium 6.7
Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & M…
-
Critical 9.8
Evaluation of closures can lead to execution of methods & functions in current program scope
neoan3-apps/template is a neoan3 minimal template engine. Versions prior to 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has…
-
Low 3.5
Default share permissions not respected for federated reshares
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.…
-
Unscored —
Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utilit…
-
Unscored —
In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file…
-
High 7.3
Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insec…
-
Medium 5.1
An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1…
-
High 8.8
Insecure Inherited Permissions in Apache Hadoop
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.