Weakness (CWE)
CWE-732: Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
How to prevent it (8 mitigations)
-
Implementation
When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user) [REF-62], and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources. [REF-207]
-
Architecture and Design, Operation
Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
Be careful to avoid CWE-243 and other weaknesses related to jails.
-
Implementation, Installation
During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
-
System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
-
Documentation
Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
-
Installation
Do not assume that a system administrator will manually change the configuration to the settings that are recommended in the software's manual.
-
Operation, System Configuration
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
Source: MITRE CWE-732
989 results · Feed
-
Unscored —
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file
-
High 7.8
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly …
-
High 7.8CVE-2023-38497 Public exploit
Cargo not respecting umask when extracting crate archives
Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate c…
-
High 7.0
Code Execution through overwriting service executable in utilities directory
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing the…
-
Unscored —
Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration f…
-
Medium 6.3
Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the reso…
-
High 7.8
Denial of Service (DoS) vulnerability in SAP SQL Anywhere
SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be le…
-
Medium 6.5
DataEase has a privilege bypass vulnerability
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed informatio…
-
High 7.5
Apache Tomcat: AJP response header mix-up
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (…
-
Medium 5.3
IBM Security Directory Suite VA information disclosure
IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 228571.
-
Unscored —CVE-2023-34852 Public exploit
PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.
-
Unscored —
In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lea…
-
Medium 6.5
Arbitrary file read vulnerability in Jenkins AWS CodeCommit Trigger Plugin
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system.
-
Low 2.0
Discourse's general category permissions could be set back to default
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, if a site has modified their general category permissions, they could be set back to the default.…
-
Medium 5.5
A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA0…
-
High 7.8
A vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set prop…
-
Low 2.7
Denial of Service in SAP NetWeaver
SAP NetWeaver (Change and Transport System) - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an authenticated user with admin privileges to maliciously run a benchmark program repeatedly in intent to slowdown or make the server unavail…
-
High 7.1
Insecure Temporary File in HuTool
Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.
-
High 7.8
Incorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL…
-
High 7.3
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate …
-
High 8.8CVE-2023-31874 Public exploit
Yank Note (YN) 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire('child_pr…
-
High 7.8CVE-2023-31748 Public exploit
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the ex…
-
High 7.5
Apache InLong: IDOR make users can delete others' subscription
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner of the de…
-
High 7.5
Apache InLong: IDOR make users can bind any cluster
Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advi…
-
Medium 4.7
When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary f…
-
High 7.5
The window management module lacks permission verification.Successful exploitation of this vulnerability may affect con…
-
High 7.8
OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Do…
-
Medium 4.3
Jenkins Tag Profiler Plugin missing permission check
A missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler statistics.
-
High 8.8
Jenkins SAML Single Sign On(SSO) Plugin missing permission checks
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins contro…
-
Medium 6.5
Jenkins Azure VM Agents Plugin missing permission checks
A missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another …
-
High 8.8CVE-2023-32986 EPSS 61%
Jenkins File Parameter Plugin arbitrary file write vulnerability
Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins contr…
-
Medium 4.3
Jenkins Email Extension Plugin missing permission check
Jenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files in the email-templates/ directory in the Jenkins home directory on…
-
Medium 5.2
Planet's secret file is created with excessive permissions
Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the fi…
-
Medium 6.5
Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may…
-
High 8.2
Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may…
-
Low 3.1
An issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and …
-
Critical 9.6
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions star…
-
High 8.1
Permissions problem in the Apache Ranger Hive Plugin
An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue a…
-
High 7.3
Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authentica…
-
High 8.1
Insecure permissions in the settings page of GARO Wallbox GLB/GTB/GTC before v189 allows attackers to redirect users to…