Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

5632 vulnerabilities reference this CWE, most recent first.

GHSA-H97Q-54JX-527J

Vulnerability from github – Published: 2022-06-21 00:00 – Updated: 2022-06-29 00:00
VLAI
Details

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-2023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-648"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-20T04:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.",
  "id": "GHSA-h97q-54jx-527j",
  "modified": "2022-06-29T00:00:25Z",
  "published": "2022-06-21T00:00:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2023"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polonel/trudesk/commit/83fd5a89319ba2c2f5934722e39b08aba9b3a4ac"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/0f35b1d3-56e6-49e4-bc5a-830f52e094b3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H99M-6755-RGWC

Vulnerability from github – Published: 2024-10-25 19:37 – Updated: 2025-04-16 13:17
VLAI
Summary
Rancher Remote Code Execution via Cluster/Node Drivers
Details

Impact

A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a –privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system.

This happens because: - During startup, Rancher appends the /opt/drivers/management-state/bin directory to the PATH environment variable. - In Rancher, the binaries /usr/bin/rancher-machine, /usr/bin/helm_v3, and /usr/bin/kustomize are assigned a UID of 1001 and a GID of 127 instead of being owned by the root user. - Rancher employs a jail mechanism to isolate the execution of node drivers from the main process. However, the drivers are executed with excessive permissions. - During the registration of new node drivers, its binary is executed with the same user as the parent process, which could enable an attacker to gain elevated privileges by registering a malicious driver. - Lack of validation on the driver file type, which allows symbolic links to be used.

Please consult the associated MITRE ATT&CK - Technique - Privilege Escalation and MITRE ATT&CK - Technique - Execution for further information about this category of attack.

Since they run at a privileged level, it is recommended to use trusted drivers only.

Patches

The fix involves some key areas with the following changes:

Fixing the PATH environment variable: - Remove the step that appends /opt/drivers/management-state/bin to the PATH environment variable.

Binaries permissions: - Correct the permission of the binaries /usr/bin/rancher-machine, /usr/bin/helm_v3, and /usr/bin/kustomize so that they are owned by the root user.

Improving Rancher jail security mechanism: - A new group jail-accessors has been created, and the rancher user has been added to this group. - The jail-accessors group is granted read and execute permissions for the directories /var/lib/rancher, /var/lib/cattle, and /usr/local/bin. - The jail mechanism has been enhanced to execute commands using the non-root rancher user and the jail-accessors group. Additionally, a new setting, UnprivilegedJailUser, has been introduced to manage this behavior, allowing users to opt-out if they need to run drivers in a more privileged context. - Limit the devices copied to the jail directory to a minimal set.

Fixing node driver registration: - The NewPlugin(driver) function in the rancher/machine module has been updated to allow setting the UID and GID for starting the plugin server. If the environment variables MACHINE_PLUGIN_UID and MACHINE_PLUGIN_GID are set, their values will be used to configure the user credentials for launching the plugin server. - Rancher now sets these environment variables with a non-root UID and GID before invoking the NewPlugin(driver) function and then unsets them after retrieving the creation flags.

Improvements on driver package: - The driver package has been revised to verify that the downloaded driver binary is a regular file. - The driver package has been revised to verify that the target file in the downloaded tar file is a regular file. - The driver package now executes the downloaded driver binary within a jail, with a default timeout of 5 seconds.

Other improvements: - The helm package has been updated to ensure appropriate permissions are set on the generated kubeconfig file. - The nodeConfig package has been updated to ensure proper permissions are applied when extracting the node configuration.

Patched versions include releases 2.7.16, 2.8.9 and 2.9.3.

Workarounds

If you can't upgrade to a fixed version, please make sure that: 1. Drivers are only executed from trusted sources. 2. The use of Admins/Restricted Admins is limited to trusted users.

References

If you have any questions or comments about this advisory: - Reach out to the SUSE Rancher Security team for security related inquiries. - Open an issue in the Rancher repository. - Verify with our support matrix and product support lifecycle.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-25T19:37:22Z",
    "nvd_published_at": "2025-04-16T09:15:27Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\nA vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the `chroot` jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the test and development environments, based on a \u2013privileged Docker container, it is possible to escape the Docker container and gain execution access on the host system. \n\nThis happens because:\n- During startup, Rancher appends the `/opt/drivers/management-state/bin` directory to the `PATH` environment variable.\n- In Rancher, the binaries `/usr/bin/rancher-machine`, `/usr/bin/helm_v3`, and `/usr/bin/kustomize` are assigned a UID of 1001 and a GID of 127 instead of being owned by the root user.\n- Rancher employs a jail mechanism to isolate the execution of node drivers from the main process. However, the drivers are executed with excessive permissions.\n- During the registration of new node drivers, its binary is executed with the same user as the parent process, which could enable an attacker to gain elevated privileges by registering a malicious driver.\n- Lack of validation on the driver file type, which allows symbolic links to be used.\n\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique - Privilege Escalation](https://attack.mitre.org/tactics/TA0004/) and [MITRE ATT\u0026CK - Technique - Execution](https://attack.mitre.org/tactics/TA0002/) for further information about this category of attack.\n\n**Since they run at a privileged level, it is recommended to use trusted drivers only.**\n\n### Patches\nThe fix involves some key areas with the following changes:\n\nFixing the `PATH` environment variable:\n- Remove the step that appends `/opt/drivers/management-state/bin` to the `PATH` environment variable.\n\nBinaries permissions:\n- Correct the permission of the binaries `/usr/bin/rancher-machine`, `/usr/bin/helm_v3`, and `/usr/bin/kustomize` so that they are owned by the root user.\n\nImproving Rancher jail security mechanism:\n- A new group `jail-accessors` has been created, and the rancher user has been added to this group.\n- The `jail-accessors` group is granted read and execute permissions for the directories `/var/lib/rancher`, `/var/lib/cattle`, and `/usr/local/bin`.\n- The jail mechanism has been enhanced to execute commands using the non-root `rancher` user and the `jail-accessors` group. Additionally, a new setting, `UnprivilegedJailUser`, has been introduced to manage this behavior, allowing users to opt-out if they need to run drivers in a more privileged context.\n- Limit the devices copied to the jail directory to a minimal set.\n\nFixing node driver registration:\n- The `NewPlugin(driver)` function in the `rancher/machine` module has been updated to allow setting the UID and GID for starting the plugin server. If the environment variables `MACHINE_PLUGIN_UID` and `MACHINE_PLUGIN_GID` are set, their values will be used to configure the user credentials for launching the plugin server. \n- Rancher now sets these environment variables with a non-root UID and GID before invoking the `NewPlugin(driver)` function and then unsets them after retrieving the creation flags.\n\nImprovements on driver package:\n- The `driver` package has been revised to verify that the downloaded driver binary is a regular file.\n- The `driver` package has been revised to verify that the target file in the downloaded tar file is a regular file.\n- The `driver` package now executes the downloaded driver binary within a jail, with a default timeout of 5 seconds.\n\nOther improvements:\n- The helm package has been updated to ensure appropriate permissions are set on the generated kubeconfig file.\n- The `nodeConfig` package has been updated to ensure proper permissions are applied when extracting the node configuration.\n\nPatched versions include releases `2.7.16`, `2.8.9` and `2.9.3`.\n\n### Workarounds\nIf you can\u0027t upgrade to a fixed version, please make sure that:\n1. Drivers are only executed from trusted sources.\n2. The use of Admins/Restricted Admins is limited to trusted users.\n\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-h99m-6755-rgwc",
  "modified": "2025-04-16T13:17:21Z",
  "published": "2024-10-25T19:37:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-h99m-6755-rgwc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22036"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22036"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher Remote Code Execution via Cluster/Node Drivers"
}

GHSA-H99V-FR29-7P28

Vulnerability from github – Published: 2021-11-20 00:00 – Updated: 2022-07-13 00:01
VLAI
Details

An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-44038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-19T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Quagga through 1.2.4. Unsafe chown/chmod operations in the suggested spec file allow users (with control of the non-root-owned directory /etc/quagga) to escalate their privileges to root upon package installation or update.",
  "id": "GHSA-h99v-fr29-7p28",
  "modified": "2022-07-13T00:01:49Z",
  "published": "2021-11-20T00:00:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44038"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1191890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Quagga/quagga/releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H9C6-H3Q2-GQ6X

Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2025-10-22 00:31
VLAI
Details

An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-0683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-11T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka \u0027Windows Installer Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0686.",
  "id": "GHSA-h9c6-h3q2-gq6x",
  "modified": "2025-10-22T00:31:50Z",
  "published": "2022-05-24T17:08:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0683"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nu11secur1ty/Windows10Exploits/blob/master/Undefined/CVE-2020-0683/README.md"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0683"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0683"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/156373/Microsoft-Windows-10-MSI-Privilege-Escalation.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H9GP-8JC8-9WPW

Vulnerability from github – Published: 2022-05-24 16:47 – Updated: 2022-12-09 18:30
VLAI
Details

IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311.

Severity
2.1 (Low)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4048"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-06T01:29:00Z",
    "severity": "LOW"
  },
  "details": "IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previous user of the same machine. IBM X-Force ID: 156311.",
  "id": "GHSA-h9gp-8jc8-9wpw",
  "modified": "2022-12-09T18:30:31Z",
  "published": "2022-05-24T16:47:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4048"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/156311"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10880147"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H9JG-77R5-R8GW

Vulnerability from github – Published: 2025-11-10 21:30 – Updated: 2025-11-10 21:30
VLAI
Details

Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-12726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-10T20:15:39Z",
    "severity": "HIGH"
  },
  "details": "Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-h9jg-77r5-r8gw",
  "modified": "2025-11-10T21:30:36Z",
  "published": "2025-11-10T21:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12726"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/447172715"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H9QM-FW5R-9VMM

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-10-27 19:00
VLAI
Details

A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-34621"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-07T13:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .",
  "id": "GHSA-h9qm-fw5r-9vmm",
  "modified": "2022-10-27T19:00:40Z",
  "published": "2022-05-24T19:07:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34621"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patched-in-profilepress-plugin"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/163973/WordPress-ProfilePress-3.1.3-Privilege-Escalation.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-H9W7-GG89-FG55

Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26
VLAI
Details

The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-0239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-03-02T11:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.",
  "id": "GHSA-h9w7-gg89-fg55",
  "modified": "2022-05-13T01:26:23Z",
  "published": "2022-05-13T01:26:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/commit/f3747379accba8e95d70cec0eae0582c8c182050"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2015:1272"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2015:2152"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2015-0239"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1186448"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f3747379accba8e95d70cec0eae0582c8c182050"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3747379accba8e95d70cec0eae0582c8c182050"
    },
    {
      "type": "WEB",
      "url": "http://permalink.gmane.org/gmane.linux.kernel.commits.head/502245"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1272.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2015/dsa-3170"
    },
    {
      "type": "WEB",
      "url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:058"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/01/27/6"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/72842"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2513-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2514-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2515-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2516-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2517-1"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2518-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-H9WW-WJG4-JVVG

Vulnerability from github – Published: 2022-09-23 00:00 – Updated: 2025-07-16 15:23
VLAI
Summary
Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module
Details

The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page's XLIFF translation file via crafted URL.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay:com.liferay.translation.web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.4.13.u36"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay.portal:release.dxp.bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.4.13.u8"
            },
            {
              "fixed": "7.4.13.u37"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-38512"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-16T15:23:43Z",
    "nvd_published_at": "2022-09-22T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Translation module before v2.0.58 from Liferay Portal (v7.4.3.12 through v7.4.3.36), and Liferay DXP 7.4 update 8 through 36 does not check permissions before allowing a user to export a web content for translation, allowing attackers to download a web content page\u0027s XLIFF translation file via crafted URL.",
  "id": "GHSA-h9ww-wjg4-jvvg",
  "modified": "2025-07-16T15:23:43Z",
  "published": "2022-09-23T00:00:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38512"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/1934094578ddcd2c1f3d37593b493d3991a6a20f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/48fd5698fc1935a90e9c5013c328dbc369ba353d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/liferay/liferay-portal"
    },
    {
      "type": "WEB",
      "url": "https://liferay.atlassian.net/browse/LPE-17610"
    },
    {
      "type": "WEB",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/cve-2022-38512?p_r_p_assetEntryId=121612585\u0026_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_redirect=https%3A%2F%2Fliferay.dev%3A443%2Fportal%2Fsecurity%2Fknown-vulnerabilities%3Fp_p_id%3Dcom_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt%26p_p_lifecycle%3D0%26p_p_state%3Dnormal%26p_p_mode%3Dview%26p_r_p_assetEntryId%3D121612585%26_com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_jekt_cur%3D0%26p_r_p_resetCur%3Dfalse"
    },
    {
      "type": "WEB",
      "url": "http://liferay.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Liferay Portal and Liferay DXP Fails to Check Permissions in Translation Module"
}

GHSA-H9X5-GF2G-5JFW

Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-05-24 17:06
VLAI
Details

An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Indexer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0613, CVE-2020-0623, CVE-2020-0625, CVE-2020-0626, CVE-2020-0627, CVE-2020-0628, CVE-2020-0629, CVE-2020-0630, CVE-2020-0631, CVE-2020-0632, CVE-2020-0633.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-0614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-14T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka \u0027Windows Search Indexer Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2020-0613, CVE-2020-0623, CVE-2020-0625, CVE-2020-0626, CVE-2020-0627, CVE-2020-0628, CVE-2020-0629, CVE-2020-0630, CVE-2020-0631, CVE-2020-0632, CVE-2020-0633.",
  "id": "GHSA-h9x5-gf2g-5jfw",
  "modified": "2022-05-24T17:06:17Z",
  "published": "2022-05-24T17:06:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0614"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0614"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list