Weakness (CWE)
CWE-283: Unverified Ownership
The product does not properly verify that a critical resource is owned by the proper entity.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
Source: MITRE CWE-283
11 results · Clear filters · Feed
-
High 7.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Virtual Input Elevation of Privilege Vulnerability
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.
-
High 7.3
Vifm 0.8.1-beta through 0.14.4 Unverified IPC FIFO Ownership Allows Cross-User Command Execution
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC pa…
-
High 7.2
Barman snapshot backup deletion trusts unverified backup catalog metadata
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman re…
-
High 8.7
Unverified access point ownership in Amazon EFS CSI Driver
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an …
-
High 7.0
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 a…
-
High 7.5
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit
A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedr…
-
High 8.4
TSPortal: Anyone can forge self-deletion requests of any user
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self…
-
High 7.8
Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability. A local low-privileged …
-
High 7.2
TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate th…
-
High 7.2
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker…