Common Weakness Enumeration

CWE-269

Discouraged

Improper Privilege Management

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

5451 vulnerabilities reference this CWE, most recent first.

GHSA-VQGF-5288-7FGG

Vulnerability from github – Published: 2024-07-09 21:30 – Updated: 2024-08-01 15:31
VLAI
Details

In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-31313"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T21:15:12Z",
    "severity": "HIGH"
  },
  "details": "In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "id": "GHSA-vqgf-5288-7fgg",
  "modified": "2024-08-01T15:31:54Z",
  "published": "2024-07-09T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31313"
    },
    {
      "type": "WEB",
      "url": "https://android.googlesource.com/platform/system/libfmq/+/79bbf4aeef4b254c52da670a972e22956c8c659d"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/2024-06-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VQPG-RQ94-24X7

Vulnerability from github – Published: 2022-05-24 17:23 – Updated: 2022-05-24 17:23
VLAI
Details

An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync Host Service Elevation of Privilege Vulnerability'.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-1434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-14T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka \u0027Windows Sync Host Service Elevation of Privilege Vulnerability\u0027.",
  "id": "GHSA-vqpg-rq94-24x7",
  "modified": "2022-05-24T17:23:08Z",
  "published": "2022-05-24T17:23:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1434"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1434"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-VQQ6-5VRP-4FFJ

Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2025-07-25 15:30
VLAI
Details

In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands.

This vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-8107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-24T08:15:31Z",
    "severity": "MODERATE"
  },
  "details": "In OceanBase\u0027s Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafted commands.\n\n\n\n\nThis vulnerability only affects OceanBase tenants in Oracle mode. Tenants in MySQL mode are unaffected.",
  "id": "GHSA-vqq6-5vrp-4ffj",
  "modified": "2025-07-25T15:30:43Z",
  "published": "2025-07-25T15:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8107"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oceanbase/oceanbase/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VR2G-RHM5-Q4JR

Vulnerability from github – Published: 2026-04-03 04:00 – Updated: 2026-05-05 18:48
VLAI
Summary
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Details

Summary

Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)

  • Stored Cross-Site Scripting via Unsanitized User Name in Profile Management

Description

The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.

This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).

Affected Functionality

  • Profile name / full name update functionality (both the 2 user inputs)
  • User profile storage and retrieval logic

Attack Scenario

  • An attacker updates their profile name to include a malicious XSS payload.
  • The application stores this value without sanitization or encoding.
  • The payload persists and executes whenever the name is rendered in affected views.

Impact

  • Persistent Stored XSS
  • Execution of arbitrary JavaScript in victims’ browsers
  • Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names

Endpoint: /backend/users/profile/

Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)

(Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces

Description

User-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.

When an administrator accesses affected pages, the stored XSS payload executes in the administrator’s browser context, resulting in administrative privilege escalation and potential full admin account takeover.

This issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to: - User management interfaces - Blog pages - Other content or UI components displaying usernames

Attack Scenario

  • Attacker injects a malicious payload via the profile name update functionality.
  • The payload is stored persistently.
  • An administrator views the user management page or any affected interface.
  • The payload executes automatically in the admin’s browser.
  • Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.

Impact

  • Stored XSS
  • Administrative privilege escalation
  • Full admin account takeover (including other roles)
  • Full compromise of the entire application

Endpoint Example: /backend/users/ of User Management Page

Steps To Reproduce (POC)

  1. Go to Profile Management page of the User
  2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as: <img src=x onerror=alert(document.domain)>
  3. Save the edit
  4. Go to User Management page as an Admin or any other role
  5. Notice the XSS alert popping up that confirms it
  6. Other endpoints aswell can execute such as blogs in the public facing one

Recommended Remediation

  1. Eliminate Unsafe DOM Sinks: Remove all usage of .html(), innerHTML, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as .text() or textContent, which do not interpret HTML markup.

  2. Implement Output Encoding: Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., <, >, ", ') are rendered as literal text rather than interpreted as executable markup.

  3. Implement Server-Side Input Sanitization: Enforce strict input validation and sanitization on all user-controlled fields — particularly the profile name fields — at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.

  4. Apply Defense in Depth: Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.

Ready Video POC:

https://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M

Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
9.4 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.28.6.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "31.0.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T04:00:57Z",
    "nvd_published_at": "2026-04-06T17:17:12Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)**\n- Stored Cross-Site Scripting via Unsanitized User Name in Profile Management\n\n### Description\nThe application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side.\n\nThis stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS).\n\n### Affected Functionality\n- Profile name / full name update functionality (both the 2 user inputs)\n- User profile storage and retrieval logic\n\n### Attack Scenario\n- An attacker updates their profile name to include a malicious XSS payload.\n- The application stores this value without sanitization or encoding.\n- The payload persists and executes whenever the name is rendered in affected views.\n\n### Impact\n- Persistent Stored XSS\n- Execution of arbitrary JavaScript in victims\u2019 browsers\n- Foundation for privilege escalation and account takeover when viewed by privileged users \u0026 normal ones across blogs and public facing pages that show user profiles full names\n\nEndpoint: `/backend/users/profile/`\n\n### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)**\n(Required for the chain)\n- Stored XSS via Unsafe Rendering of User Names Across Administrative and Public Interfaces\n\n### Description\nUser-controlled profile fields (specifically the username / full name) are rendered unsafely across multiple application endpoints, including administrative and content-related interfaces. The application fails to apply proper output encoding when displaying these values.\n\nWhen an administrator accesses affected pages, the stored XSS payload executes in the administrator\u2019s browser context, resulting in administrative privilege escalation and potential full admin account takeover.\n\nThis issue is not limited to a single endpoint and affects all areas where the username is rendered, including but not limited to:\n- User management interfaces\n- Blog pages\n- Other content or UI components displaying usernames\n\n### Attack Scenario\n- Attacker injects a malicious payload via the profile name update functionality.\n- The payload is stored persistently.\n- An administrator views the user management page or any affected interface.\n- The payload executes automatically in the admin\u2019s browser.\n- Attacker hijacks the admin session, performs privileged actions, or fully compromises the admin account.\n\n### Impact\n- Stored XSS\n- Administrative privilege escalation\n- Full admin account takeover (including other roles)\n- Full compromise of the entire application\n\nEndpoint Example: `/backend/users/` of User Management Page\n\n## Steps To Reproduce (POC)\n1. Go to Profile Management page of the User\n2. In the 2 user inputs of the Full Name, put in any field of them a XSS Payload such as:\n`\u003cimg src=x onerror=alert(document.domain)\u003e`\n3. Save the edit\n4. Go to User Management page as an Admin or any other role\n5. Notice the XSS alert popping up that confirms it\n6. Other endpoints aswell can execute such as blogs in the public facing one \n\n### Recommended Remediation\n\n1. **Eliminate Unsafe DOM Sinks:** Remove all usage of `.html()`, `innerHTML`, and similar unsafe DOM manipulation methods throughout the application. These sinks should be replaced with safe alternatives such as `.text()` or `textContent`, which do not interpret HTML markup.\n\n2. **Implement Output Encoding:** Apply context-appropriate HTML entity encoding to all user-controlled data before rendering it in the DOM. This ensures that any special characters (e.g., `\u003c`, `\u003e`, `\"`, `\u0027`) are rendered as literal text rather than interpreted as executable markup.\n\n3. **Implement Server-Side Input Sanitization:** Enforce strict input validation and sanitization on all user-controlled fields \u2014 particularly the profile name fields \u2014 at the server level before storing values in the database. Currently, no sanitization is applied to these inputs.\n\n4. **Apply Defense in Depth:** Even in cases where user input does not appear to flow directly into a dangerous sink, it should still be treated as untrusted. Attackers can and will leverage indirect data flows to exploit the application. A layered approach combining input validation, output encoding, and Content Security Policy (CSP) headers is strongly recommended.\n# Ready Video POC:\nhttps://mega.nz/file/iEVEyT4Y#f046o6ZwYBfS1kK0HNKOCFm6tL_8_SbLtWWKC1hYC4M",
  "id": "GHSA-vr2g-rhm5-q4jr",
  "modified": "2026-05-05T18:48:46Z",
  "published": "2026-04-03T04:00:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vr2g-rhm5-q4jr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34989"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CI4MS: Profile \u0026 User Management Full Account Takeover for All-Roles \u0026 Privilege-Escalation via Stored DOM XSS"
}

GHSA-VR33-265G-QGJ3

Vulnerability from github – Published: 2022-12-05 15:30 – Updated: 2022-12-06 21:30
VLAI
Details

In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441637; Issue ID: ALPS07441637.

Severity
6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-32633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-05T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441637; Issue ID: ALPS07441637.",
  "id": "GHSA-vr33-265g-qgj3",
  "modified": "2022-12-06T21:30:46Z",
  "published": "2022-12-05T15:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32633"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/December-2022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VR5H-VJ63-Q73M

Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2022-05-24 17:32
VLAI
Details

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3. An application may be able to execute arbitrary code with kernel privileges.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-8841"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-27T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.3 and iPadOS 13.3. An application may be able to execute arbitrary code with kernel privileges.",
  "id": "GHSA-vr5h-vj63-q73m",
  "modified": "2022-05-24T17:32:26Z",
  "published": "2022-05-24T17:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8841"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT210785"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-VR6P-MMXJ-PHM2

Vulnerability from github – Published: 2024-03-13 18:31 – Updated: 2024-03-13 18:31
VLAI
Details

An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-2431"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T18:15:08Z",
    "severity": "MODERATE"
  },
  "details": "An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect with a passcode.",
  "id": "GHSA-vr6p-mmxj-phm2",
  "modified": "2024-03-13T18:31:36Z",
  "published": "2024-03-13T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2431"
    },
    {
      "type": "WEB",
      "url": "https://security.paloaltonetworks.com/CVE-2024-2431"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRMR-FJXH-FM4G

Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30
VLAI
Details

Faulkner Wildlife Issues in the New Millennium 18.0.160 on Windows allows local, low-privileged users to gain privileges by creating a malicious "%SYSTEMDRIVE%\Course Software Material 18.0.1.9\cmd.exe" file.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-26894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-08T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Faulkner Wildlife Issues in the New Millennium 18.0.160 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"%SYSTEMDRIVE%\\Course Software Material 18.0.1.9\\cmd.exe\" file.",
  "id": "GHSA-vrmr-fjxh-fm4g",
  "modified": "2022-05-24T17:30:21Z",
  "published": "2022-05-24T17:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26894"
    },
    {
      "type": "WEB",
      "url": "https://github.com/livecode/livecode/pull/7454"
    },
    {
      "type": "WEB",
      "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://john-woodman.com/posts/Privilege-Escalation-Vulnerability-Faulkner-Press"
    },
    {
      "type": "WEB",
      "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-VRR3-M9RH-W6RG

Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2023-02-03 15:31
VLAI
Details

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-25T15:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 and 6.0.0.1 could allow an authenticated user to view process definition of a business process without permission. IBM X-Force ID: 159231.",
  "id": "GHSA-vrr3-m9rh-w6rg",
  "modified": "2023-02-03T15:31:18Z",
  "published": "2022-05-24T16:44:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4222"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/159231"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10880595"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/108110"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VRW4-W73R-6MM8

Vulnerability from github – Published: 2021-08-30 16:12 – Updated: 2021-09-13 20:30
VLAI
Summary
TimelockController vulnerability in OpenZeppelin Contracts
Details

Impact

A vulnerability in TimelockController allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

Patches

A fix is included in the following releases of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable: - 4.3.1 - 3.4.2 - 3.4.2-solc-0.7

Deployed instances of TimelockController should be replaced with a fixed version by migrating all assets, ownership, and roles.

Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

References

Post-mortem.

Credits

The issue was identified by an anonymous white hat hacker through Immunefi.

For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.

Severity
10.0 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@openzeppelin/contracts-upgradeable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@openzeppelin/contracts-upgradeable"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-08-27T12:57:31Z",
    "nvd_published_at": "2021-08-27T00:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nA vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to \"open\" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.\n\n### Patches\n\nA fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:\n- 4.3.1\n- 3.4.2\n- 3.4.2-solc-0.7\n\nDeployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.\n\n### Workarounds\n\nRevoke the executor role from accounts not strictly under the team\u0027s control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.\n\n### References\n\n[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).\n\n### Credits\n\nThe issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).\n\n### For more information\n\nIf you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.\n",
  "id": "GHSA-vrw4-w73r-6mm8",
  "modified": "2021-09-13T20:30:25Z",
  "published": "2021-08-30T16:12:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/security/advisories/GHSA-vrw4-w73r-6mm8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39168"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeabl"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "TimelockController vulnerability in OpenZeppelin Contracts"
}
Mitigation MIT-1
Architecture and Design Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Mitigation MIT-48
Architecture and Design

Strategy: Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Mitigation MIT-49
Architecture and Design

Strategy: Separation of Privilege

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

CAPEC-122: Privilege Abuse

An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.

CAPEC-233: Privilege Escalation

An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.

CAPEC-58: Restful Privilege Elevation

An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.

← Back to the CWE list