CWE-276
AllowedIncorrect Default Permissions
Abstraction: Base · Status: Draft
During installation, installed file permissions are set to allow anyone to modify those files.
2043 vulnerabilities reference this CWE, most recent first.
GHSA-6X35-4QMM-3QJG
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2024-04-04 02:47An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
{
"affected": [],
"aliases": [
"CVE-2019-17103"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-27T14:15:00Z",
"severity": "MODERATE"
},
"details": "An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.",
"id": "GHSA-6x35-4qmm-3qjg",
"modified": "2024-04-04T02:47:04Z",
"published": "2022-05-24T17:07:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17103"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/support/security-advisories/get-task-allow-entitlement-via-bdldaemon-macos-va-3448"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6X3J-5VFG-CRPG
Vulnerability from github – Published: 2022-08-13 00:00 – Updated: 2022-08-17 00:00In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of tethering interfaces with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-162952629
{
"affected": [],
"aliases": [
"CVE-2022-20341"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-12T15:15:00Z",
"severity": "MODERATE"
},
"details": "In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of tethering interfaces with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-162952629",
"id": "GHSA-6x3j-5vfg-crpg",
"modified": "2022-08-17T00:00:33Z",
"published": "2022-08-13T00:00:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20341"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6X7X-GCMF-7R8X
Vulnerability from github – Published: 2026-07-09 20:57 – Updated: 2026-07-09 20:57Summary
The {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users.
The action's delete() callee is PageManager::deleteOrphaned(), which despite its name does not check whether the target page is orphaned: it issues an unconditional DELETE against pages, links, acls, triples, referrers, and tags tables.
Details
Three issues compose the vulnerability.
actions/EraseSpamedCommentsAction.phpperforms no authorization check before processing$_POST['clean']/$_POST['suppr'][]inactions/EraseSpamedCommentsAction.php:
```php
public function run()
{
$wiki = &$this->wiki;
ob_start();
// ...
elseif (isset($_POST['clean'])) {
$deletedPages = '';
if (!empty($_POST['suppr'])) {
foreach ($_POST['suppr'] as $page) {
echo 'Effacement de : ' . $page . "
\n";
if ($wiki->services->get(PageController::class)->delete($page)) {
$deletedPages .= $page . ', ';
}
}
}
}
} ```
No UserIsAdmin(), no UserIsOwner(), no HasAccess('write', $page) per-target check, no CSRF token check.
- The default action ACL grants access to everyone in
includes/YesWiki.php:
php
$acl = empty($this->config['permissions'][$moduleType][$module])
? '*'
: $this->config['permissions'][$moduleType][$module];
php
if ($acl === null) { return true; }
return $this->CheckACL($acl, $user);
No shipped permissions map gates erasespamedcomments to admins, so Performer::CheckModuleACL('erasespamedcomments', 'action') returns true for anonymous users.
PageController::delete()andPageManager::deleteOrphaned()perform no authorization check and do not validate that the page is actually orphaned inincludes/controllers/PageController.php:38–48:
php
public function delete(string $tag): bool
{
if ($this->entryManager->isEntry($tag)) {
return $this->entryController->delete($tag);
} else {
$this->pageManager->deleteOrphaned($tag);
$this->wiki->LogAdministrativeAction(
$this->authController->getLoggedUserName(),
'Suppression de la page ->""' . $tag . '""'
);
return true;
}
}
in includes/services/PageManager.php:289–310:
php
public function deleteOrphaned($tag)
{
if ($this->securityController->isWikiHibernated()) { throw new \Exception(_t('WIKI_IN_HIBERNATION')); }
unset($this->ownersCache[$tag]);
if (in_array($tag, $this->pageCache)) { unset($this->pageCache[$tag]); }
$this->dbService->query("DELETE FROM ... WHERE tag='{$this->dbService->escape($tag)}' OR comment_on='{$this->dbService->escape($tag)}'");
$this->dbService->query("DELETE FROM ...links... WHERE from_tag='{$this->dbService->escape($tag)}' ");
$this->dbService->query("DELETE FROM ...acls... WHERE page_tag='{$this->dbService->escape($tag)}' ");
// ...further unconditional DELETEs across triples, referrers, tags
}
The companion isOrphaned() method (line 284) exists but is never called from deleteOrphaned(). The function name is misleading as it deletes any page, not just orphans.
PoC
Default fresh install where default_write_acl='*' (per includes/YesWikiInit.php:219), anonymous browsing.
- create a trigger page (anonymous)
POST /?wiki=SpamCleanup/edit HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded
body=%7B%7Berasespamedcomments%7D%7D&submit=1
This succeeds because the new page passes aclService->hasAccess('write', 'SpamCleanup') against default_write_acl='*'.
- trigger arbitrary page deletion (anonymous)
POST /?wiki=SpamCleanup HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded
clean=yes&suppr%5B0%5D=PagePrincipale&suppr%5B1%5D=AnotherTargetPage
Server response includes Effacement de : PagePrincipale and Effacement de : AnotherTargetPage. pages, links, acls, triples, referrers, and tags rows for those tags are deleted from the database.
Impact
Arbitrary page deletion, including the front page (PagePrincipale).
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yeswiki/yeswiki"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52766"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T20:57:25Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\n\nThe `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` array from `POST` and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki\u0027s allow-by-default action ACL model, any user who has page write access, which is the default for everyone (`default_write_acl=\u0027*\u0027`) on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users.\n\nThe action\u0027s `delete()` callee is `PageManager::deleteOrphaned()`, which despite its name does not check whether the target page is orphaned: it issues an unconditional `DELETE` against `pages`, `links`, `acls`, `triples`, `referrers`, and `tags` tables.\n\n### Details\n\nThree issues compose the vulnerability.\n\n1. `actions/EraseSpamedCommentsAction.php` performs no authorization check before processing `$_POST[\u0027clean\u0027]` / `$_POST[\u0027suppr\u0027][]` in `actions/EraseSpamedCommentsAction.php`:\n\n ```php\n public function run()\n {\n $wiki = \u0026$this-\u003ewiki;\n ob_start();\n // ...\n elseif (isset($_POST[\u0027clean\u0027])) { \n $deletedPages = \u0027\u0027;\n if (!empty($_POST[\u0027suppr\u0027])) { \n foreach ($_POST[\u0027suppr\u0027] as $page) {\n echo \u0027Effacement de : \u0027 . $page . \"\u003cbr /\u003e\\n\";\n if ($wiki-\u003eservices-\u003eget(PageController::class)-\u003edelete($page)) { \n $deletedPages .= $page . \u0027, \u0027;\n }\n }\n }\n \n }\n }\n ```\n\n No `UserIsAdmin()`, no `UserIsOwner()`, no `HasAccess(\u0027write\u0027, $page)` per-target check, no CSRF token check.\n\n2. The default action ACL grants access to everyone in `includes/YesWiki.php`:\n\n ```php\n $acl = empty($this-\u003econfig[\u0027permissions\u0027][$moduleType][$module])\n ? \u0027*\u0027\n : $this-\u003econfig[\u0027permissions\u0027][$moduleType][$module];\n ```\n\n ```php\n if ($acl === null) { return true; }\n return $this-\u003eCheckACL($acl, $user);\n ```\n\n No shipped `permissions` map gates `erasespamedcomments` to admins, so `Performer::CheckModuleACL(\u0027erasespamedcomments\u0027, \u0027action\u0027)` returns `true` for anonymous users.\n\n3. `PageController::delete()` and `PageManager::deleteOrphaned()` perform no authorization check and do not validate that the page is actually orphaned in `includes/controllers/PageController.php:38\u201348`:\n\n ```php\n public function delete(string $tag): bool\n {\n if ($this-\u003eentryManager-\u003eisEntry($tag)) {\n return $this-\u003eentryController-\u003edelete($tag);\n } else {\n $this-\u003epageManager-\u003edeleteOrphaned($tag);\n $this-\u003ewiki-\u003eLogAdministrativeAction(\n $this-\u003eauthController-\u003egetLoggedUserName(),\n \u0027Suppression de la page -\u003e\"\"\u0027 . $tag . \u0027\"\"\u0027\n );\n return true;\n }\n }\n ```\nin `includes/services/PageManager.php:289\u2013310`:\n ```php\n public function deleteOrphaned($tag)\n {\n if ($this-\u003esecurityController-\u003eisWikiHibernated()) { throw new \\Exception(_t(\u0027WIKI_IN_HIBERNATION\u0027)); }\n unset($this-\u003eownersCache[$tag]);\n if (in_array($tag, $this-\u003epageCache)) { unset($this-\u003epageCache[$tag]); }\n $this-\u003edbService-\u003equery(\"DELETE FROM ... WHERE tag=\u0027{$this-\u003edbService-\u003eescape($tag)}\u0027 OR comment_on=\u0027{$this-\u003edbService-\u003eescape($tag)}\u0027\");\n $this-\u003edbService-\u003equery(\"DELETE FROM ...links... WHERE from_tag=\u0027{$this-\u003edbService-\u003eescape($tag)}\u0027 \");\n $this-\u003edbService-\u003equery(\"DELETE FROM ...acls... WHERE page_tag=\u0027{$this-\u003edbService-\u003eescape($tag)}\u0027 \");\n // ...further unconditional DELETEs across triples, referrers, tags\n }\n ```\n\n The companion `isOrphaned()` method (line 284) exists but is never called from `deleteOrphaned()`. The function name is misleading as it deletes any page, not just orphans.\n\n### PoC\n\nDefault fresh install where `default_write_acl=\u0027*\u0027` (per `includes/YesWikiInit.php:219`), anonymous browsing.\n\n1. create a trigger page (anonymous)\n\n```http\nPOST /?wiki=SpamCleanup/edit HTTP/1.1\nHost: target.example\nContent-Type: application/x-www-form-urlencoded\n\nbody=%7B%7Berasespamedcomments%7D%7D\u0026submit=1\n```\n\nThis succeeds because the new page passes `aclService-\u003ehasAccess(\u0027write\u0027, \u0027SpamCleanup\u0027)` against `default_write_acl=\u0027*\u0027`.\n\n2. trigger arbitrary page deletion (anonymous)\n\n```http\nPOST /?wiki=SpamCleanup HTTP/1.1\nHost: target.example\nContent-Type: application/x-www-form-urlencoded\n\nclean=yes\u0026suppr%5B0%5D=PagePrincipale\u0026suppr%5B1%5D=AnotherTargetPage\n```\n\nServer response includes `Effacement de : PagePrincipale` and `Effacement de : AnotherTargetPage`. `pages`, `links`, `acls`, `triples`, `referrers`, and `tags` rows for those tags are deleted from the database.\n\n### Impact\n\n Arbitrary page deletion, including the front page (`PagePrincipale`).",
"id": "GHSA-6x7x-gcmf-7r8x",
"modified": "2026-07-09T20:57:25Z",
"published": "2026-07-09T20:57:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x"
},
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef"
},
{
"type": "PACKAGE",
"url": "https://github.com/YesWiki/yeswiki"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action"
}
GHSA-6X8M-F958-Q43M
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2022-02-23 00:01Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.
{
"affected": [],
"aliases": [
"CVE-2022-23996"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.",
"id": "GHSA-6x8m-f958-q43m",
"modified": "2022-02-23T00:01:28Z",
"published": "2022-02-12T00:00:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23996"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6XH4-6995-PPC6
Vulnerability from github – Published: 2025-01-22 00:33 – Updated: 2025-01-22 18:31In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-43765"
],
"database_specific": {
"cwe_ids": [
"CWE-1021",
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T23:15:13Z",
"severity": "HIGH"
},
"details": "In multiple locations, there is a possible way to obtain access to a folder due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.",
"id": "GHSA-6xh4-6995-ppc6",
"modified": "2025-01-22T18:31:55Z",
"published": "2025-01-22T00:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43765"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6XVJ-X5F6-3FG6
Vulnerability from github – Published: 2022-11-10 12:01 – Updated: 2025-05-01 15:31There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may cause the dialog box for confirming the pairing not to be displayed during Bluetooth pairing.
{
"affected": [],
"aliases": [
"CVE-2022-44548"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-09T21:15:00Z",
"severity": "MODERATE"
},
"details": "There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may cause the dialog box for confirming the pairing not to be displayed during Bluetooth pairing.",
"id": "GHSA-6xvj-x5f6-3fg6",
"modified": "2025-05-01T15:31:29Z",
"published": "2022-11-10T12:01:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44548"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2022/11"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202211-0000001441016433"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6XWF-XVF3-V459
Vulnerability from github – Published: 2024-03-01 12:30 – Updated: 2024-11-01 21:32Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.
Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-26280"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-01T21:40:55Z",
"nvd_published_at": "2024-03-01T11:15:08Z",
"severity": "MODERATE"
},
"details": "Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view.\u00a0With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by default, they need to be explicitly granted permissions to see the logs. Only admin users have audit log permission by default.\n\nUsers of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability",
"id": "GHSA-6xwf-xvf3-v459",
"modified": "2024-11-01T21:32:49Z",
"published": "2024-03-01T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26280"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/37501"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/1a96407cd2d76616c1137de288f092d4f3b097fa"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/7f10998c17ab9d725bc8671deb4c12d672bfba99"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/8324c87e05741e5a673c43b315619a3788bacc2e"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/8463ee4f25114a6c5fb2408d6026afe94bdf106d"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/f2ea8a3e1753012bfe0d529c9c8be66cf55ca28f"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/f4b9cc74976b7df1acbc3c63471b5751b3e2c40c"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-42.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/knskxxxml95091rsnpxkpo1jjp8rj0fh"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/01/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users"
}
GHSA-72H9-MPVP-P445
Vulnerability from github – Published: 2022-11-09 12:00 – Updated: 2022-11-09 19:02In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-237540408
{
"affected": [],
"aliases": [
"CVE-2022-20448"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-08T22:15:00Z",
"severity": "MODERATE"
},
"details": "In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-237540408",
"id": "GHSA-72h9-mpvp-p445",
"modified": "2022-11-09T19:02:26Z",
"published": "2022-11-09T12:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20448"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-11-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7369-X5Q2-RH2M
Vulnerability from github – Published: 2024-08-06 15:30 – Updated: 2024-08-07 00:30It was possible for a web extension with minimal permissions to create a StreamFilter which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1.
{
"affected": [],
"aliases": [
"CVE-2024-7525"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-284"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T13:15:57Z",
"severity": "CRITICAL"
},
"details": "It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox \u003c 129, Firefox ESR \u003c 115.14, and Firefox ESR \u003c 128.1.",
"id": "GHSA-7369-x5q2-rh2m",
"modified": "2024-08-07T00:30:47Z",
"published": "2024-08-06T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7525"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1909298"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-33"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-34"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-35"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-37"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-38"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-73H7-VPGM-Q573
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-05-24 19:21Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-33090"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-17T19:15:00Z",
"severity": "HIGH"
},
"details": "Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-73h7-vpgm-q573",
"modified": "2022-05-24T19:21:01Z",
"published": "2022-05-24T19:21:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33090"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00568.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-1
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.