CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
444 vulnerabilities reference this CWE, most recent first.
GHSA-6P7M-F494-CJVP
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
{
"affected": [],
"aliases": [
"CVE-2018-3762"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T16:29:00Z",
"severity": "MODERATE"
},
"details": "Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.",
"id": "GHSA-6p7m-f494-cjvp",
"modified": "2022-05-13T01:32:20Z",
"published": "2022-05-13T01:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3762"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/358339"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=nc-sa-2018-002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6R8G-4HXG-92RF
Vulnerability from github – Published: 2024-04-08 09:31 – Updated: 2024-10-31 21:31Permission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.
{
"affected": [],
"aliases": [
"CVE-2023-52542"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T09:15:08Z",
"severity": "MODERATE"
},
"details": "Permission verification vulnerability in the system module.\nImpact: Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-6r8g-4hxg-92rf",
"modified": "2024-10-31T21:31:44Z",
"published": "2024-04-08T09:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52542"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/3"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202403-0000001667644725"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6V2P-8Q89-F8P6
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407
{
"affected": [],
"aliases": [
"CVE-2020-0327"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-18T16:15:00Z",
"severity": "MODERATE"
},
"details": "In core networking, there is a missing permission check. This could lead to local information disclosure of app network usage with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129151407",
"id": "GHSA-6v2p-8q89-f8p6",
"modified": "2022-05-24T17:28:39Z",
"published": "2022-05-24T17:28:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0327"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6WVR-WRJW-5G3C
Vulnerability from github – Published: 2025-06-10 12:30 – Updated: 2025-06-10 18:32Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.
This impacts OmniStudio: before Spring 2025.
{
"affected": [],
"aliases": [
"CVE-2025-43700"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T12:15:24Z",
"severity": "HIGH"
},
"details": "Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data.\u00a0\n\nThis impacts OmniStudio: before Spring 2025.",
"id": "GHSA-6wvr-wrjw-5g3c",
"modified": "2025-06-10T18:32:25Z",
"published": "2025-06-10T12:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43700"
},
{
"type": "WEB",
"url": "https://help.salesforce.com/s/articleView?id=004980323\u0026type=1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-72CP-Q9J9-FHVH
Vulnerability from github – Published: 2024-10-02 15:30 – Updated: 2024-10-03 21:31A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.
{
"affected": [],
"aliases": [
"CVE-2024-44193"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-02T15:15:14Z",
"severity": "HIGH"
},
"details": "A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.",
"id": "GHSA-72cp-q9j9-fhvh",
"modified": "2024-10-03T21:31:04Z",
"published": "2024-10-02T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44193"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121328"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-72G7-HPV6-J389
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151645626
{
"affected": [],
"aliases": [
"CVE-2020-0269"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-18T16:15:00Z",
"severity": "MODERATE"
},
"details": "In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151645626",
"id": "GHSA-72g7-hpv6-j389",
"modified": "2022-05-24T17:28:32Z",
"published": "2022-05-24T17:28:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0269"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-72Q2-GWWF-6HRV
Vulnerability from github – Published: 2023-10-17 14:25 – Updated: 2023-10-17 14:25Impact
There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable.
This issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don’t already have.
Mitigation
This issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0.0"
},
{
"fixed": "2.11.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45807"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-17T14:25:36Z",
"nvd_published_at": "2023-10-16T22:15:12Z",
"severity": "MODERATE"
},
"details": "### Impact\nThere is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations on index metadata of dashboards and visualizations in that tenant, potentially rendering them unavailable.\n\nThis issue does not affect index data, only metadata. Dashboards correctly enforces read-only permissions when indexing and updating documents. This issue does not provide additional read access to data users don\u2019t already have.\n\n### Mitigation\nThis issue can be mitigated by disabling the tenants functionality for the cluster. Versions 1.3.14 and 2.11.0 contain a fix for this issue.\n\n### For more information\nIf you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to\u00a0[aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.",
"id": "GHSA-72q2-gwwf-6hrv",
"modified": "2023-10-17T14:25:36Z",
"published": "2023-10-17T14:25:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-72q2-gwwf-6hrv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45807"
},
{
"type": "PACKAGE",
"url": "https://github.com/opensearch-project/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "OpenSearch Issue with tenant read-only permissions"
}
GHSA-76CF-8M83-6VV8
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-17 00:01Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
{
"affected": [],
"aliases": [
"CVE-2022-24618"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T17:46:00Z",
"severity": "HIGH"
},
"details": "Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the \"Browse For Folder\" window accessible by triggering a \"Repair\" on the MSI package located in C:\\Windows\\Installer.",
"id": "GHSA-76cf-8m83-6vv8",
"modified": "2022-03-17T00:01:25Z",
"published": "2022-03-11T00:02:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24618"
},
{
"type": "WEB",
"url": "https://support.heimdalsecurity.com/hc/en-us/articles/4425942979473-2-5-398-PROD-and-2-5-401-RC"
},
{
"type": "WEB",
"url": "http://heimdal.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-76F2-5PMW-P3QG
Vulnerability from github – Published: 2025-01-14 00:30 – Updated: 2025-01-23 18:31Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the "AclList/SaveAclRules" administrative function.
{
"affected": [],
"aliases": [
"CVE-2023-42228"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-13T22:15:10Z",
"severity": "HIGH"
},
"details": "Pat Infinite Solutions HelpdeskAdvanced \u003c= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can edit their own ACL rules by sending a request to the \"AclList/SaveAclRules\" administrative function.",
"id": "GHSA-76f2-5pmw-p3qg",
"modified": "2025-01-23T18:31:15Z",
"published": "2025-01-14T00:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42228"
},
{
"type": "WEB",
"url": "https://gitlab.com/daniele_m/cve-list/-/blob/main/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-77R2-Q4C3-V635
Vulnerability from github – Published: 2022-12-19 09:30 – Updated: 2023-01-04 18:31GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
{
"affected": [],
"aliases": [
"CVE-2022-47547"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T09:15:00Z",
"severity": "MODERATE"
},
"details": "GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.",
"id": "GHSA-77r2-q4c3-v635",
"modified": "2023-01-04T18:31:01Z",
"published": "2022-12-19T09:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47547"
},
{
"type": "WEB",
"url": "https://arxiv.org/pdf/2212.05197.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.