CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5632 vulnerabilities reference this CWE, most recent first.
GHSA-2575-C77R-RR97
Vulnerability from github – Published: 2022-04-29 02:59 – Updated: 2022-04-29 02:59gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.
{
"affected": [],
"aliases": [
"CVE-2004-1349"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-10-04T04:00:00Z",
"severity": "LOW"
},
"details": "gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.",
"id": "GHSA-2575-c77r-rr97",
"modified": "2022-04-29T02:59:24Z",
"published": "2022-04-29T02:59:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-1349"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17577"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1654"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/12744"
},
{
"type": "WEB",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-57600-1\u0026searchclause=security"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/635998"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11318"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-2589-6CHQ-5GJ4
Vulnerability from github – Published: 2022-05-02 03:39 – Updated: 2022-05-02 03:39The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
{
"affected": [],
"aliases": [
"CVE-2009-2848"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-08-18T21:00:00Z",
"severity": "MODERATE"
},
"details": "The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-\u003eclear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.",
"id": "GHSA-2589-6chq-5gj4",
"modified": "2022-05-02T03:39:16Z",
"published": "2022-05-02T03:39:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2848"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52899"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11412"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8598"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9766"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2009-1550.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01256.html"
},
{
"type": "WEB",
"url": "http://article.gmane.org/gmane.linux.kernel/871942"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2009-1243.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35983"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36501"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36562"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36759"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37105"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37351"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37471"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/08/04/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/08/05/10"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-1438.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/512019/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-852-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3316"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-25F5-GC4H-HC22
Vulnerability from github – Published: 2021-12-08 19:55 – Updated: 2023-09-05 21:51The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "devise_masquerade"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28680"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2021-12-08T19:36:08Z",
"nvd_published_at": "2021-12-07T21:15:00Z",
"severity": "HIGH"
},
"details": "The devise_masquerade gem before 1.3 allows certain attacks when a password\u0027s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the \"back\" action will go back to without knowing that user\u0027s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.",
"id": "GHSA-25f5-gc4h-hc22",
"modified": "2023-09-05T21:51:12Z",
"published": "2021-12-08T19:55:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28680"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/issues/83"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/pull/76"
},
{
"type": "PACKAGE",
"url": "https://github.com/oivoodoo/devise_masquerade"
},
{
"type": "WEB",
"url": "https://github.com/oivoodoo/devise_masquerade/releases/tag/v1.3.1"
},
{
"type": "WEB",
"url": "https://labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Privilege Management in devise_masquerade"
}
GHSA-25F7-HGG7-XWPG
Vulnerability from github – Published: 2024-08-13 12:30 – Updated: 2024-08-13 12:30Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.
{
"affected": [],
"aliases": [
"CVE-2024-43121"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T11:15:18Z",
"severity": "CRITICAL"
},
"details": "Improper Privilege Management vulnerability in realmag777 HUSKY allows Privilege Escalation.This issue affects HUSKY: from n/a through 1.3.6.1.",
"id": "GHSA-25f7-hgg7-xwpg",
"modified": "2024-08-13T12:30:53Z",
"published": "2024-08-13T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43121"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-products-filter/wordpress-husky-plugin-1-3-6-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-25H3-MW3P-W8R7
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2023-08-22 14:34Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14201"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T20:18:41Z",
"nvd_published_at": "2020-08-21T19:15:00Z",
"severity": "MODERATE"
},
"details": "Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which \"disabled\" is changed to \"enabled\" in the HTML source code.",
"id": "GHSA-25h3-mw3p-w8r7",
"modified": "2023-08-22T14:34:53Z",
"published": "2022-05-24T17:26:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14201"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/blob/e76641c491e4105e9cb1ded6149771c621d822b5/ChangeLog#L2933"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-011"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Dolibarr CRM allows Privilege Escalation"
}
GHSA-25H7-QCGX-8445
Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Event Logging Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1365.
{
"affected": [],
"aliases": [
"CVE-2020-1371"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists when the Windows Event Logging Service improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka \u0027Windows Event Logging Service Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-1365.",
"id": "GHSA-25h7-qcgx-8445",
"modified": "2022-05-24T17:23:01Z",
"published": "2022-05-24T17:23:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1371"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1371"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-25W6-FX24-W953
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-07-13 00:01Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP's customers. This can lead to any user having a limited insight into other customer's infrastructure and potential data cross-contamination.
{
"affected": [],
"aliases": [
"CVE-2021-35225"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-21T18:15:00Z",
"severity": "MODERATE"
},
"details": "Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath Services from all that MSP\u0027s customers. This can lead to any user having a limited insight into other customer\u0027s infrastructure and potential data cross-contamination.",
"id": "GHSA-25w6-fx24-w953",
"modified": "2022-07-13T00:01:27Z",
"published": "2022-05-24T19:18:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35225"
},
{
"type": "WEB",
"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm"
},
{
"type": "WEB",
"url": "https://support.solarwinds.com/SuccessCenter/s/article/NPM-2020-2-6-Hotfix-2?language=en_US"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-25X7-989G-366H
Vulnerability from github – Published: 2023-06-21 21:30 – Updated: 2024-04-04 04:59A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.
{
"affected": [],
"aliases": [
"CVE-2023-0971"
],
"database_specific": {
"cwe_ids": [
"CWE-268",
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-21T20:15:09Z",
"severity": "HIGH"
},
"details": "A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.",
"id": "GHSA-25x7-989g-366h",
"modified": "2024-04-04T04:59:31Z",
"published": "2023-06-21T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0971"
},
{
"type": "WEB",
"url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-262M-7362-275Q
Vulnerability from github – Published: 2022-05-13 01:41 – Updated: 2022-05-13 01:41Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2017-10098"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-08T15:29:00Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affected are 11.3.0, 11.4.0, 12.0.1, 12.0.2, 12.0.3, 12.1.0, 12.2.0 and 12.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle FLEXCUBE Universal Banking. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Universal Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Universal Banking accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).",
"id": "GHSA-262m-7362-275q",
"modified": "2022-05-13T01:41:24Z",
"published": "2022-05-13T01:41:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10098"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99856"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038934"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-263F-979Q-W9H5
Vulnerability from github – Published: 2023-10-26 18:30 – Updated: 2023-11-07 21:30The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter.
{
"affected": [],
"aliases": [
"CVE-2023-41966"
],
"database_specific": {
"cwe_ids": [
"CWE-267",
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-26T17:15:08Z",
"severity": "HIGH"
},
"details": "\n\n\nThe application suffers from a privilege escalation vulnerability. A \nuser with read permissions can elevate privileges by sending a HTTP POST\n to set a parameter.\n\n\n\n\n\n\n\n",
"id": "GHSA-263f-979q-w9h5",
"modified": "2023-11-07T21:30:22Z",
"published": "2023-10-26T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41966"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08"
},
{
"type": "WEB",
"url": "https://www.sielco.org/en/contacts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.