CWE-250
AllowedExecution with Unnecessary Privileges
Abstraction: Base · Status: Draft
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
665 vulnerabilities reference this CWE, most recent first.
GHSA-92XG-GMRQ-5C3W
Vulnerability from github – Published: 2024-09-07 09:30 – Updated: 2025-01-21 17:53Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-45034"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-09T18:16:43Z",
"nvd_published_at": "2024-09-07T08:15:11Z",
"severity": "HIGH"
},
"details": "Apache Airflow versions before 2.10.1 have a vulnerability that allows\u00a0DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. \nUsers are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.",
"id": "GHSA-92xg-gmrq-5c3w",
"modified": "2025-01-21T17:53:29Z",
"published": "2024-09-07T09:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45034"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/41672"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-212.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/09/06/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Airflow vulnerable to Execution with Unnecessary Privileges"
}
GHSA-93FP-JHR5-HVM4
Vulnerability from github – Published: 2024-05-16 18:30 – Updated: 2024-05-16 18:30IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 283985.
{
"affected": [],
"aliases": [
"CVE-2024-27260"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-16T17:16:01Z",
"severity": "HIGH"
},
"details": "IBM AIX could 7.2, 7.3, VIOS 3.1, and VIOS 4.1 allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 283985.",
"id": "GHSA-93fp-jhr5-hvm4",
"modified": "2024-05-16T18:30:32Z",
"published": "2024-05-16T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27260"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/283985"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7152543"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-958W-8F9Q-43J8
Vulnerability from github – Published: 2026-10-13 15:32 – Updated: 2026-10-13 15:32NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-65162"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-13T13:17:32Z",
"severity": "CRITICAL"
},
"details": "NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.",
"id": "GHSA-958w-8f9q-43j8",
"modified": "2026-10-13T15:32:20Z",
"published": "2026-10-13T15:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65162"
},
{
"type": "WEB",
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5889"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-65162"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-97J3-FVQP-6GPF
Vulnerability from github – Published: 2026-04-28 15:30 – Updated: 2026-09-30 12:35mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface.
This issue affects mpGabinet version 23.12.19 and below.
{
"affected": [],
"aliases": [
"CVE-2026-40550"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-28T14:16:13Z",
"severity": "MODERATE"
},
"details": "mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application\u2019s memory by inspecting the running process. While ability to retrieve credentials from memory is expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface.\n\n\nThis issue affects mpGabinet version 23.12.19 and below.",
"id": "GHSA-97j3-fvqp-6gpf",
"modified": "2026-09-30T12:35:09Z",
"published": "2026-04-28T15:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40550"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/04/CVE-2026-40550"
},
{
"type": "WEB",
"url": "https://www.binsoft.pl/produkty"
},
{
"type": "WEB",
"url": "https://www.mpgabinet.pl"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-97PG-WR4R-53WR
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.
{
"affected": [],
"aliases": [
"CVE-2024-11821"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:25Z",
"severity": "MODERATE"
},
"details": "A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-id}/model-config, allowing unauthorized users to alter chatbot configurations.",
"id": "GHSA-97pg-wr4r-53wr",
"modified": "2025-03-20T12:32:42Z",
"published": "2025-03-20T12:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11821"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/76d5986d-3882-4ea7-81cb-f00400e5c6b6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98F3-7G2J-289Q
Vulnerability from github – Published: 2026-10-14 12:31 – Updated: 2026-10-14 12:31The insights-runtime-extractor runs as a privileged DaemonSet (hostPID: true)
that scans container processes for runtime fingerprinting. When scanning a
container, the coordinator:
- fork()s a child process
- setns() into the target container's PID and mount namespaces
- fchdir() back to an orphaned FD pointing at the extractor's own root
filesystem (where
/crio.sockis hostPath-mounted) - Calls only
seteuid(target_uid)— changing the effective UID but leaving the real UID and saved-set-UID at 0 and retaining the permitted capability set - The
check_no_privileged_perms()guard inspects only the Effective capability set (so it passes), and is skipped entirely when the target runs as uid 0 - The
VersionExecutablefingerprint invokesfpr_kind_executablewithprocess.command_line[0]— the target's argv[0], read from/proc/<pid>/cmdlineand fully controlled by the workload fpr_kind_executablecallsexec.Command(executable, "--version").Output()— executing the workload's own binary inside the workload's mount namespace while ruid=0 in the host user namespace
The executed process can call setuid(0) to restore full root with
CAP_SYS_ADMIN, and inherits the orphaned cwd which resolves into the extractor
container's filesystem containing the host CRI-O socket.
Affected Code
1. Insufficient privilege drop (Rust — extractor coordinator)
File: extractor/src/insights_runtime_extractor.rs
// Lines 139-146 — seteuid-only drop, guard skipped for root containers
join_process_namespaces(process.pid)?;
change_dir(current_dir);
switch_user(*process.uid)?;
if *process.uid != 0 {
perms::check_no_privileged_perms()
.expect("Must not have privileged permissions to run fingerprints");
}
fingerprint::run_fingerprints(&config, out_dir, &process);
// Lines 182-185 — only effective UID changed; ruid/suid stay 0
fn switch_user(uid: u32) -> Result<(), ScannerError> {
debug!("... Becoming user: {uid}");
seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
}
2. Execution of untrusted binary (Go — fingerprint)
File: fingerprints/pkg/utils/file.go
// Lines 75-80 — executes a path taken verbatim from workload's argv[0]
func GetExecutableVersionOutput(executable string) (string, error) {
out, err := exec.Command(executable, "--version").Output()
if err != nil {
return "", err
}
return string(out), nil
}
3. Workload-controlled path forwarded (Rust — version_executable)
File: version_executable.rs
// Lines 29-34 — workload-controlled command_line[0] forwarded to fingerprint
return Some(vec![
fpr_kind_executable,
out_dir.to_string(),
String::from(&process.command_line[0]),
String::from(&version_executable.runtime_kind_name),
]);
Attack Pattern
Attacker: Any tenant able to schedule a pod (unprivileged, any namespace) Victim: The node running the insights-runtime-extractor DaemonSet Trigger: Automatic — the DaemonSet scans all container processes on the node
Attack sequence:
- Attacker creates a pod whose process name matches a configured
versioned-executable pattern (
node,python,python3,MainThread, or containsjava) - The pod's main binary (at the path matching argv[0]) is a malicious
executable that calls
setuid(0)to restore root - When the insights operator triggers a scan, the DaemonSet forks, enters the attacker's mount namespace, and executes the attacker's binary with ruid=0
- The attacker's code regains full root with
CAP_SYS_ADMINin the host user namespace - The inherited cwd contains the host CRI-O socket → full node compromise
{
"affected": [],
"aliases": [
"CVE-2026-104795"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T11:16:59Z",
"severity": "HIGH"
},
"details": "The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)\nthat scans container processes for runtime fingerprinting. When scanning a\ncontainer, the coordinator:\n\n1. **fork()s** a child process\n2. **setns()** into the target container\u0027s PID and mount namespaces\n3. **fchdir()** back to an orphaned FD pointing at the extractor\u0027s own root\n filesystem (where `/crio.sock` is hostPath-mounted)\n4. Calls **only `seteuid(target_uid)`** \u2014 changing the effective UID but leaving\n the **real UID and saved-set-UID at 0** and **retaining the permitted\n capability set**\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability\n set (so it passes), and is **skipped entirely when the target runs as uid 0**\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with\n `process.command_line[0]` \u2014 the target\u0027s argv[0], read from\n `/proc/\u003cpid\u003e/cmdline` and **fully controlled by the workload**\n7. `fpr_kind_executable` calls `exec.Command(executable, \"--version\").Output()`\n \u2014 executing the **workload\u0027s own binary** inside the workload\u0027s mount\n namespace while **ruid=0 in the host user namespace**\n\nThe executed process can call `setuid(0)` to restore full root with\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor\ncontainer\u0027s filesystem containing the host CRI-O socket.\n\n## Affected Code\n\n### 1. Insufficient privilege drop (Rust \u2014 extractor coordinator)\n\n**File:** `extractor/src/insights_runtime_extractor.rs`\n\n```rust\n// Lines 139-146 \u2014 seteuid-only drop, guard skipped for root containers\njoin_process_namespaces(process.pid)?;\nchange_dir(current_dir);\nswitch_user(*process.uid)?;\nif *process.uid != 0 {\n perms::check_no_privileged_perms()\n .expect(\"Must not have privileged permissions to run fingerprints\");\n}\nfingerprint::run_fingerprints(\u0026config, out_dir, \u0026process);\n```\n\n```rust\n// Lines 182-185 \u2014 only effective UID changed; ruid/suid stay 0\nfn switch_user(uid: u32) -\u003e Result\u003c(), ScannerError\u003e {\n debug!(\"... Becoming user: {uid}\");\n seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))\n}\n```\n\n### 2. Execution of untrusted binary (Go \u2014 fingerprint)\n\n**File:** `fingerprints/pkg/utils/file.go`\n\n```go\n// Lines 75-80 \u2014 executes a path taken verbatim from workload\u0027s argv[0]\nfunc GetExecutableVersionOutput(executable string) (string, error) {\n out, err := exec.Command(executable, \"--version\").Output()\n if err != nil {\n return \"\", err\n }\n return string(out), nil\n}\n```\n\n### 3. Workload-controlled path forwarded (Rust \u2014 version_executable)\n\n**File:** `version_executable.rs`\n\n```rust\n// Lines 29-34 \u2014 workload-controlled command_line[0] forwarded to fingerprint\nreturn Some(vec![\n fpr_kind_executable,\n out_dir.to_string(),\n String::from(\u0026process.command_line[0]),\n String::from(\u0026version_executable.runtime_kind_name),\n]);\n```\n\n## Attack Pattern\n\n**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)\n**Victim:** The node running the insights-runtime-extractor DaemonSet\n**Trigger:** Automatic \u2014 the DaemonSet scans all container processes on the node\n\n**Attack sequence:**\n\n1. Attacker creates a pod whose process name matches a configured\n versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,\n or contains `java`)\n2. The pod\u0027s main binary (at the path matching argv[0]) is a malicious\n executable that calls `setuid(0)` to restore root\n3. When the insights operator triggers a scan, the DaemonSet forks, enters the\n attacker\u0027s mount namespace, and executes the attacker\u0027s binary with ruid=0\n4. The attacker\u0027s code regains full root with `CAP_SYS_ADMIN` in the host user\n namespace\n5. The inherited cwd contains the host CRI-O socket \u2192 full node compromise",
"id": "GHSA-98f3-7g2j-289q",
"modified": "2026-10-14T12:31:33Z",
"published": "2026-10-14T12:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104795"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-104795"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543917"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-98V3-6PHW-46HC
Vulnerability from github – Published: 2024-03-09 06:30 – Updated: 2024-08-26 18:33An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.
{
"affected": [],
"aliases": [
"CVE-2023-50015"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-09T05:15:08Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.",
"id": "GHSA-98v3-6phw-46hc",
"modified": "2024-08-26T18:33:32Z",
"published": "2024-03-09T06:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50015"
},
{
"type": "WEB",
"url": "https://github.com/n0obit4/Vulnerability_Disclosure/tree/main/CVE-2023-50015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-998Q-4G4X-CWCJ
Vulnerability from github – Published: 2025-10-15 15:30 – Updated: 2025-10-21 21:33A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2025-61958"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-15T14:15:57Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh\u00a0restrictions and gain access to a bash shell.\u00a0 For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-998q-4g4x-cwcj",
"modified": "2025-10-21T21:33:30Z",
"published": "2025-10-15T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61958"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000154647"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-9CJ6-MQJ9-659V
Vulnerability from github – Published: 2024-11-18 18:30 – Updated: 2024-11-18 18:30A vulnerability in system file transfer functions of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileges on the underlying operating system. The vulnerability is due to improper validation of path input to the system file transfer functions. An attacker could exploit this vulnerability by sending requests that contain specially crafted path variables to the vulnerable system. A successful exploit could allow the attacker to overwrite arbitrary files, allowing the attacker to modify the system in such a way that could allow the attacker to gain escalated privileges.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2020-26074"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T16:15:06Z",
"severity": "HIGH"
},
"details": "A vulnerability in system file transfer functions of Cisco\u0026nbsp;SD-WAN vManage Software could allow an authenticated, local attacker to gain escalated privileges on the underlying operating system.\nThe vulnerability is due to improper validation of path input to the system file transfer functions. An attacker could exploit this vulnerability by sending requests that contain specially crafted path variables to the vulnerable system. A successful exploit could allow the attacker to overwrite arbitrary files, allowing the attacker to modify the system in such a way that could allow the attacker to gain escalated privileges.Cisco\u0026nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.",
"id": "GHSA-9cj6-mqj9-659v",
"modified": "2024-11-18T18:30:55Z",
"published": "2024-11-18T18:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26074"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-escalation-Jhqs5Skf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9F82-PR9C-9F3X
Vulnerability from github – Published: 2025-04-10 21:31 – Updated: 2025-04-10 21:31An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations.
{
"affected": [],
"aliases": [
"CVE-2025-23008"
],
"database_specific": {
"cwe_ids": [
"CWE-250"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-10T19:16:00Z",
"severity": "HIGH"
},
"details": "An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations.",
"id": "GHSA-9f82-pr9c-9f3x",
"modified": "2025-04-10T21:31:09Z",
"published": "2025-04-10T21:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23008"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Mitigation MIT-18
Strategy: Separation of Privilege
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation MIT-18
Strategy: Attack Surface Reduction
Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.
Mitigation
Perform extensive input validation for any privileged code that must be exposed to the user and reject anything that does not fit your strict requirements.
Mitigation MIT-19
When dropping privileges, ensure that they have been dropped successfully to avoid CWE-273. As protection mechanisms in the environment get stronger, privilege-dropping calls may fail even if it seems like they would always succeed.
Mitigation
If circumstances force you to run with extra privileges, then determine the minimum access level necessary. First identify the different permissions that the software and its users will need to perform their actions, such as file read and write permissions, network socket permissions, and so forth. Then explicitly allow those actions while denying all else [REF-76]. Perform extensive input validation and canonicalization to minimize the chances of introducing a separate vulnerability. This mitigation is much more prone to error than dropping the privileges in the first place.
Mitigation MIT-37
Strategy: Environment Hardening
Ensure that the software runs properly under the United States Government Configuration Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many organizations use to limit the attack surface and potential risk of deployed software.
CAPEC-104: Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.
CAPEC-470: Expanding Control over the Operating System from the Database
An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
CAPEC-69: Target Programs with Elevated Privileges
This attack targets programs running with elevated privileges. The adversary tries to leverage a vulnerability in the running program and get arbitrary code to execute with elevated privileges.