CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5517 vulnerabilities reference this CWE, most recent first.
GHSA-255J-2693-VHWC
Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2022-05-24 17:25FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service.
{
"affected": [],
"aliases": [
"CVE-2020-9078"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-10T20:15:00Z",
"severity": "MODERATE"
},
"details": "FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service.",
"id": "GHSA-255j-2693-vhwc",
"modified": "2022-05-24T17:25:15Z",
"published": "2022-05-24T17:25:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9078"
},
{
"type": "WEB",
"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-fusioncompute-en"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-255J-56MH-HP3W
Vulnerability from github – Published: 2022-05-13 01:43 – Updated: 2022-05-13 01:43IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691.
{
"affected": [],
"aliases": [
"CVE-2017-1493"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-09T20:29:00Z",
"severity": "MODERATE"
},
"details": "IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691.",
"id": "GHSA-255j-56mh-hp3w",
"modified": "2022-05-13T01:43:34Z",
"published": "2022-05-13T01:43:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1493"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/128691"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg2C1000367"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102483"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-255P-HFWR-9QM4
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-29 00:00This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.
{
"affected": [],
"aliases": [
"CVE-2022-32782"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T19:15:00Z",
"severity": "MODERATE"
},
"details": "This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.",
"id": "GHSA-255p-hfwr-9qm4",
"modified": "2022-09-29T00:00:27Z",
"published": "2022-09-25T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32782"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213257"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2575-C77R-RR97
Vulnerability from github – Published: 2022-04-29 02:59 – Updated: 2022-04-29 02:59gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.
{
"affected": [],
"aliases": [
"CVE-2004-1349"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-10-04T04:00:00Z",
"severity": "LOW"
},
"details": "gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.",
"id": "GHSA-2575-c77r-rr97",
"modified": "2022-04-29T02:59:24Z",
"published": "2022-04-29T02:59:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1349"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17577"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1654"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/12744"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-57600-1\u0026searchclause=security"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/635998"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11318"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2589-6CHQ-5GJ4
Vulnerability from github – Published: 2022-05-02 03:39 – Updated: 2022-05-02 03:39The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
{
"affected": [],
"aliases": [
"CVE-2009-2848"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-08-18T21:00:00Z",
"severity": "MODERATE"
},
"details": "The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-\u003eclear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.",
"id": "GHSA-2589-6chq-5gj4",
"modified": "2022-05-02T03:39:16Z",
"published": "2022-05-02T03:39:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2848"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52899"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11412"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8598"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9766"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1550.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01256.html"
},
{
"type": "WEB",
"url": "http://article.gmane.org/gmane.linux.kernel/871942"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1243.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35983"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36501"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36562"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36759"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37105"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37351"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37471"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/08/04/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/08/05/10"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1438.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/512019/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-852-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3316"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-25F5-GC4H-HC22
Vulnerability from github – Published: 2021-12-08 19:55 – Updated: 2023-09-05 21:51The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "devise_masquerade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28680"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-08T19:36:08Z",
"nvd_published_at": "2021-12-07T21:15:00Z",
"severity": "HIGH"
},
"details": "The devise_masquerade gem before 1.3 allows certain attacks when a password\u0027s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the \"back\" action will go back to without knowing that user\u0027s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.",
"id": "GHSA-25f5-gc4h-hc22",
"modified": "2023-09-05T21:51:12Z",
"published": "2021-12-08T19:55:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28680"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/issues/83"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/pull/76"
},
{
"type": "PACKAGE",
"url": "https://github.com/oivoodoo/devise_masquerade"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/releases/tag/v1.3.1"
},
{
"type": "WEB",
"url": "https://labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Privilege Management in devise_masquerade"
}
GHSA-25F7-HGG7-XWPG
Vulnerability from github – Published: 2024-08-13 12:30 – Updated: 2024-08-13 12:30Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
{
"affected": [],
"aliases": [
"CVE-2024-43121"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T11:15:18Z",
"severity": "CRITICAL"
},
"details": "Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.",
"id": "GHSA-25f7-hgg7-xwpg",
"modified": "2024-08-13T12:30:53Z",
"published": "2024-08-13T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43121"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-6-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-25H3-MW3P-W8R7
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2023-08-22 14:34Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14201"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T20:18:41Z",
"nvd_published_at": "2020-08-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which \"disabled\" is changed to \"enabled\" in the HTML source code.",
"id": "GHSA-25h3-mw3p-w8r7",
"modified": "2023-08-22T14:34:53Z",
"published": "2022-05-24T17:26:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14201"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/blob/e76641c491e4105e9cb1ded6149771c621d822b5/ChangeLog#L2933"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Dolibarr CRM allows Privilege Escalation"
}
GHSA-25H7-QCGX-8445
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Event Logging Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1365.
{
"affected": [],
"aliases": [
"CVE-2020-1371"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka \u0027Windows Event Logging Service Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1365.",
"id": "GHSA-25h7-qcgx-8445",
"modified": "2022-05-24T17:23:01Z",
"published": "2022-05-24T17:23:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1371"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1371"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-25W6-FX24-W953
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-07-13 00:01Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
{
"affected": [],
"aliases": [
"CVE-2021-35225"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-21T18:15:00Z",
"severity": "MODERATE"
},
"details": "Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP\u0027s customers. This can lead to any user having a limited insight into other customer\u0027s infrastructure and potential data cross-contamination.",
"id": "GHSA-25w6-fx24-w953",
"modified": "2022-07-13T00:01:27Z",
"published": "2022-05-24T19:18:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35225"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm"
},
{
"type": "WEB",
"url": "https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_US"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.