CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5637 vulnerabilities reference this CWE, most recent first.
GHSA-6422-47GP-W7V8
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-13 00:01In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196855999
{
"affected": [],
"aliases": [
"CVE-2021-39618"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-196855999",
"id": "GHSA-6422-47gp-w7v8",
"modified": "2022-07-13T00:01:37Z",
"published": "2022-01-15T00:01:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39618"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6428-3M47-F5W9
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2024-10-08 18:33Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1651.
{
"affected": [],
"aliases": [
"CVE-2021-1680"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T20:15:00Z",
"severity": "HIGH"
},
"details": "Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-1651.",
"id": "GHSA-6428-3m47-f5w9",
"modified": "2024-10-08T18:33:00Z",
"published": "2022-05-24T17:38:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1680"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1680"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1680"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-644W-28VG-VRRC
Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2024-04-04 08:54The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
{
"affected": [],
"aliases": [
"CVE-2023-39733"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-25T18:17:29Z",
"severity": "HIGH"
},
"details": "The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.",
"id": "GHSA-644w-28vg-vrrc",
"modified": "2024-04-04T08:54:49Z",
"published": "2023-10-25T18:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39733"
},
{
"type": "WEB",
"url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39733.md"
},
{
"type": "WEB",
"url": "https://liff.line.me/1656987103-bk5k9PO4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6456-HR4P-P4PQ
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-07-13 00:01Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2021-20617"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-14T09:15:00Z",
"severity": "CRITICAL"
},
"details": "Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified vectors.",
"id": "GHSA-6456-hr4p-p4pq",
"modified": "2022-07-13T00:01:05Z",
"published": "2022-05-24T17:39:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20617"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN35906450/index.html"
},
{
"type": "WEB",
"url": "https://www.acmailer.jp/info/de.cgi?id=101"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6465-6PFQ-MJ4H
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2025-11-25 18:32When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
{
"affected": [],
"aliases": [
"CVE-2017-7803"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-11T21:29:00Z",
"severity": "HIGH"
},
"details": "When a page\u0027s content security policy (CSP) header contains a \"sandbox\" directive, other directives are ignored. This results in the incorrect enforcement of CSP. This vulnerability affects Thunderbird \u003c 52.3, Firefox ESR \u003c 52.3, and Firefox \u003c 55.",
"id": "GHSA-6465-6pfq-mj4h",
"modified": "2025-11-25T18:32:09Z",
"published": "2022-05-13T01:47:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7803"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2456"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2534"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1377426"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201803-14"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3928"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-3968"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2017-18"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2017-19"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2017-20"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100234"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1039124"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-64FX-J998-RQP7
Vulnerability from github – Published: 2023-12-01 06:30 – Updated: 2023-12-08 21:30An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.
{
"affected": [],
"aliases": [
"CVE-2023-45253"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-01T06:15:47Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.",
"id": "GHSA-64fx-j998-rqp7",
"modified": "2023-12-08T21:30:30Z",
"published": "2023-12-01T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45253"
},
{
"type": "WEB",
"url": "https://www.xlent.no/aktuelt/security-disclosure-of-vulnerabilities-cve-2023-45252-and-cve-2023-45253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64G7-MVW6-V9QJ
Vulnerability from github – Published: 2022-01-14 21:09 – Updated: 2022-01-14 20:50Impact
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patches
Patched in shelljs 0.8.5
Workarounds
Recommended action is to upgrade to 0.8.5.
References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
For more information
If you have any questions or comments about this advisory: * Ask at https://github.com/shelljs/shelljs/issues/1058 * Open an issue at https://github.com/shelljs/shelljs/issues/new
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "shelljs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-14T20:50:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nOutput from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.\n\nOther shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.\n\n### Patches\nPatched in shelljs 0.8.5\n\n### Workarounds\nRecommended action is to upgrade to 0.8.5.\n\n### References\nhttps://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Ask at https://github.com/shelljs/shelljs/issues/1058\n* Open an issue at https://github.com/shelljs/shelljs/issues/new\n",
"id": "GHSA-64g7-mvw6-v9qj",
"modified": "2022-01-14T20:50:57Z",
"published": "2022-01-14T21:09:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shelljs/shelljs/security/advisories/GHSA-64g7-mvw6-v9qj"
},
{
"type": "PACKAGE",
"url": "https://github.com/shelljs/shelljs"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Privilege Management in shelljs"
}
GHSA-64JQ-M7RQ-768H
Vulnerability from github – Published: 2024-06-17 22:30 – Updated: 2024-10-16 17:26Impact
A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific scenarios can lead to privilege escalation.
The bug in the webhook rule resolver ignores rules from a ClusterRole for external RoleTemplates when its context is set to either project or is left empty. The fix introduces a new field to the RoleTemplate CRD named ExternalRules. The new field will be used to resolve rules directly from the RoleTemplate. Additionally, rules from the backing ClusterRole will be used if ExternalRules is not provided. The new field will always take precedence when it is set, and serve as the source of truth for rules used when creating Rancher resources on the local cluster.
Please note that this is a breaking change for external RoleTemplates, when context is set to project or empty and the backing ClusterRole does not exist, as this was not previously required.
Important: The fix is automatically applied when upgrading to the release lines 2.8and above. For users still on the 2.7 release line, after the upgrade to a patched version, users are required to opt-in to the fix by enabling the external-rules feature flag.
Please consult the associated MITRE ATT&CK - Technique - Exploitation for Privilege Escalation for further information about this category of attack.
Patches
Patched versions include releases 2.7.14 and 2.8.5.
Workarounds
The following script was developed for Rancher Manager administrators to identify RoleTemplates impacted by this vulnerability. The script requires jq installed and a kubeconfig with access to Rancher local cluster; it can also be executed in Rancher's kubectl shell.
#!/bin/bash
set -euo pipefail
# get all RoleTemplates with .context == "project" or .context == "" that don't have externalRules.
rts=$(kubectl get roletemplates -o json | jq -r '.items[] | select((.context == "project" or .context == "") and .external == true and .externalRules == null and .builtin == false) | .metadata.name')
found_invalid_rt=false
for rt in $rts; do
if ! kubectl get clusterrole "$rt" > /dev/null 2>&1; then
echo "$rt" # prints RoleTemplate names that don't have a backing ClusterRole
found_invalid_rt=true
fi
done
if ! $found_invalid_rt ; then
echo 'This cluster is not affected by CVE-2023-32197: no RoleTemplate objects found'
fi
It will return all objects affected by this vulnerability. The administrator can fix those objects by creating the backing ClusterRole that they refer to.
References
If you have any questions or comments about this advisory: - Reach out to the SUSE Rancher Security team for security-related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32196"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T22:30:51Z",
"nvd_published_at": "2024-10-16T13:15:13Z",
"severity": "HIGH"
},
"details": "### Impact\nA vulnerability has been identified whereby privilege escalation checks are not properly enforced for `RoleTemplate`objects when external=true, which in specific scenarios can lead to privilege escalation.\n\nThe bug in the webhook rule resolver ignores rules from a `ClusterRole` for external `RoleTemplates` when its context is set to either `project` or is left empty. The fix introduces a new field to the `RoleTemplate` CRD named `ExternalRules`. The new field will be used to resolve rules directly from the `RoleTemplate`. Additionally, rules from the backing `ClusterRole` will be used if `ExternalRules` is not provided. The new field will always take precedence when it is set, and serve as the source of truth for rules used when creating Rancher resources on the local cluster.\n\nPlease note that this is a breaking change for external `RoleTemplates`, when context is set to `project` or empty and the backing `ClusterRole` does not exist, as this was not previously required.\n\n**Important:** The fix is automatically applied when upgrading to the release lines `2.8`and above. For users still on the `2.7` release line, after the upgrade to a patched version, users are required to opt-in to the fix by enabling the `external-rules` [feature flag](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/feature-flags).\n\nPlease consult the associated [MITRE ATT\u0026CK - Technique - Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/) for further information about this category of attack.\n\n### Patches\nPatched versions include releases `2.7.14` and `2.8.5`.\n\n### Workarounds\nThe following script was developed for Rancher Manager administrators to identify `RoleTemplates` impacted by this vulnerability. The script requires `jq` installed and a `kubeconfig` with access to Rancher local cluster; it can also be executed in Rancher\u0027s kubectl shell.\n\n```bash\n#!/bin/bash\nset -euo pipefail\n\n# get all RoleTemplates with .context == \"project\" or .context == \"\" that don\u0027t have externalRules.\nrts=$(kubectl get roletemplates -o json | jq -r \u0027.items[] | select((.context == \"project\" or .context == \"\") and .external == true and .externalRules == null and .builtin == false) | .metadata.name\u0027)\nfound_invalid_rt=false\n\nfor rt in $rts; do\n if ! kubectl get clusterrole \"$rt\" \u003e /dev/null 2\u003e\u00261; then\n echo \"$rt\" # prints RoleTemplate names that don\u0027t have a backing ClusterRole\n found_invalid_rt=true\n fi\ndone\n\nif ! $found_invalid_rt ; then\n echo \u0027This cluster is not affected by CVE-2023-32197: no RoleTemplate objects found\u0027\nfi\n```\n\nIt will return all objects affected by this vulnerability. The administrator can fix those objects by creating the backing `ClusterRole` that they refer to.\n\n\n### References\n- [CVE-2023-32196](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32196)\n\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security-related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
"id": "GHSA-64jq-m7rq-768h",
"modified": "2024-10-16T17:26:07Z",
"published": "2024-06-17T22:30:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-64jq-m7rq-768h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32196"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32196"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/rancher"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Rancher\u0027s External RoleTemplates can lead to privilege escalation"
}
GHSA-64PF-M95P-GCG5
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-0157"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-17T20:15:00Z",
"severity": "MODERATE"
},
"details": "Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-64pf-m95p-gcg5",
"modified": "2022-05-24T19:20:59Z",
"published": "2022-05-24T19:20:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0157"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00562.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-64Q3-RQ3X-XVFJ
Vulnerability from github – Published: 2023-12-21 21:30 – Updated: 2023-12-21 21:30Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.
{
"affected": [],
"aliases": [
"CVE-2023-6804"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-21T21:15:15Z",
"severity": "MODERATE"
},
"details": "Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. \n",
"id": "GHSA-64q3-rq3x-xvfj",
"modified": "2023-12-21T21:30:32Z",
"published": "2023-12-21T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6804"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12"
},
{
"type": "WEB",
"url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.