Weakness (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
How to prevent it (8 mitigations)
-
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Implementation, Installation
During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
-
System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
-
Documentation
Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
-
Installation
Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-732
435 results · Clear filters · Feed
-
High 7.2
Talos worker join token can be used to get elevated access level to the Talos API
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos con…
-
High 8.8
Apache ShenYu Admin Improper Privilege Management
Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
High 7.5
An information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f…
-
High 8.8
Ovarro TBox Incorrect Permission Assignment for Critical Resource
Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Paralle…
-
High 7.8
A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designe…
-
High 7.8
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.…
-
High 7.3
Privilege Escalation in Miele Benchmark Programming Tool
In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An attacker with low privileges may trick a user with administrative privileges to execute these binar…
-
High 8.1
Improper Access Control in shopware
Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1…
-
High 7.8
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due …
KEV Apr 15, 2022 -
High 8.8
Incorrect Permission Assignment for Critical Resource in zerotier/zerotierone
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
-
High 7.8
CODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.
The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted memory space.
-
High 8.8
SaltStack Salt Permissions Bypass
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectl…
-
High 7.6
NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unp…
-
High 7.8
Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate…
-
High 7.5
Write access to VMO data through copy-on-write in Fuchsia
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5…
-
High 8.4
SECURITY - OPC Server for AC 800M - Remote Code Execution Vulnerability
Incorrect Permission Assignment for Critical Resource vulnerability in OPC Server for AC 800M allows an attacker to execute arbitrary code in the node running the AC800M OPC Server.
-
High 8.8
Sunnet eHRD - Broken Access Control
Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page after being authenticated as a general user, then perform privilege escalation to execute arbitrary code and control the system or interrupt …
-
High 7.8
Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges unde…
-
High 7.3
AUVESY Versiondog
The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to gain SYSDBA permissions.
-
High 8.8
MacOS version of Multipass incorrect owner for application directory
The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner.
-
High 8.8
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrit…
-
High 7.8
Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulne…
-
High 7.8
Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulne…
-
High 7.8
Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated us…
-
High 8.8
rancher: API group not properly specified when creating Kubernetes RBAC resources
A Incorrect Permission Assignment for Critical Resource vulnerability in Rancher allows users in the cluster to modify resources they should not have access to. This issue affects: Rancher versions prior to 2.5.9 ; Rancher versions prior to 2.4.16.
-
High 7.5
Private files publicly accessible with Cloud Storage providers
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility acco…
-
High 8.2
Moodle command execution vulnerability exists in the default legacy spellchecker plugin
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job …
-
High 7.8
A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code exec…
-
High 7.0
Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource v…
-
High 8.8
Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possib…
-
High 8.1CVE-2020-17533 Public exploit
Apache Accumulo Improper Handling of Insufficient Permissions
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values o…
-
High 7.8
Acronis True Image 2021 fails to properly set ACLs of the C:\ProgramData\Acronis directory. Because some privileged pro…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.3…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798…
-
High 8.8
Insecure permissions on build temporary rootfs in Singularity
Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
-
High 8.1
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity
Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.
-
High 8.2
Privilege Escalation vulnerability in McAfee DXL for Mac
Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer (DXL) Client for Mac shipped with McAfee Agent (MA) for Mac prior to MA 5.6.6 allows local users to run commands as root via incorrectly applied permissions on temporary files.