Common Weakness Enumeration

CWE-273

Allowed

Improper Check for Dropped Privileges

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

69 vulnerabilities reference this CWE, most recent first.

GHSA-5Q67-RFF6-C784

Vulnerability from github – Published: 2026-08-19 09:31 – Updated: 2026-08-27 18:31
VLAI
Details

As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged.

An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-58086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T08:17:12Z",
    "severity": "HIGH"
  },
  "details": "As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user.  Tracing configured by a jailed root user was therefore not flagged as privileged.\n\nAn unprivileged user in a jail that has permission to debug the target process can modify the jailed root user\u0027s ktrace(2) flags, or disable tracing outright.  A jailed root user therefore cannot reliably trace unprivileged processes.",
  "id": "GHSA-5q67-rff6-c784",
  "modified": "2026-08-27T18:31:54Z",
  "published": "2026-08-19T09:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58086"
    },
    {
      "type": "WEB",
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-26:53.ktrace.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5R6C-GJ4G-R697

Vulnerability from github – Published: 2026-10-08 21:58 – Updated: 2026-10-08 21:58
VLAI
Summary
PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
Details

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports. Its strict() classmethod is explicitly described as creating "a strict security policy for untrusted code," setting allow_subprocess=False and allow_file_write=False, and inheriting default blocked_paths (/etc/passwd, /etc/shadow, ~/.ssh, ~/.aws, ~/.config) and blocked_commands (rm -rf, dd, mkfs, fdisk, shutdown, reboot). The default sandbox backend, Subprocess Sandbox (praisonai/sandbox/subprocess.py), implements code/command execution by writing input to a temp file and invoking it via asyncio.create_subprocess_exec() directly, with no checking of any kind against blocked_commands, blocked_imports, blocked_paths, allow_subprocess, or allow_file_write. A search across every sandbox backend file in the repository confirms these fields are referenced nowhere outside the data class that declares them. Only allow_network and max_output_size are actually consulted. Verification Using a Security Policy.strict()-configured Sandbox Config(sandbox_type="subprocess") and the real Subprocess Sandbox:

subprocess.run(['id'], ...) executed and returned uid=0(root) gid=0(root) groups=0(root) — despite allow_subprocess=False. open('/etc/passwd').read() returned the real file contents in full — despite /etc/passwd being explicitly listed in blocked_paths. A shell command containing rm -rf actually created and then deleted a real test directory (confirmed via echo DELETED after the operation) — despite "rm -rf" being explicitly listed in blocked_commands.

All three were run against the same sandbox instance in one session, confirming simultaneous failure across the policy's command, path, and subprocess restrictions. Impact Any deployment relying on the default subprocess sandbox type — including via the API's own recommended strict() configuration for untrusted code — receives no actual protection against subprocess creation, sensitive file access, or destructive command execution. Since subprocess requires no extra dependencies and is the default Sandbox Config.sandbox_type, this is plausibly the active backend in many real deployments rather than an edge case. Root cause Security Policy was designed as a backend-agnostic configuration surface, but only allow_network and max_output_size were ever wired into Subprocess Sandbox. The remaining fields exist as fully-documented configuration with no corresponding enforcement code in this backend. Suggested remediation Enforce blocked_commands/blocked_imports/blocked_paths/allow_subprocess/allow_file_write in Subprocess Sandbox before invoking the child process, or — given the well-known limits of denylist-style matching — default to the already-implemented native backend (Landlock/Seatbelt) for untrusted code rather than the unenforced subprocess backend. Consider having SecurityPolicy.strict() raise if instantiated against a backend that cannot enforce its fields.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-60085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T21:58:11Z",
    "nvd_published_at": "2026-07-15T17:16:52Z",
    "severity": "HIGH"
  },
  "details": "Summary\nSecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports. Its strict() classmethod is explicitly described as creating \"a strict security policy for untrusted code,\" setting allow_subprocess=False and allow_file_write=False, and inheriting default blocked_paths (/etc/passwd, /etc/shadow, ~/.ssh, ~/.aws, ~/.config) and blocked_commands (rm -rf, dd, mkfs, fdisk, shutdown, reboot).\nThe default sandbox backend, Subprocess Sandbox (praisonai/sandbox/subprocess.py), implements code/command execution by writing input to a temp file and invoking it via asyncio.create_subprocess_exec() directly, with no checking of any kind against blocked_commands, blocked_imports, blocked_paths, allow_subprocess, or allow_file_write. A search across every sandbox backend file in the repository confirms these fields are referenced nowhere outside the data class that declares them. Only allow_network and max_output_size are actually consulted.\nVerification\nUsing a Security Policy.strict()-configured Sandbox Config(sandbox_type=\"subprocess\") and the real Subprocess Sandbox:\n\nsubprocess.run([\u0027id\u0027], ...) executed and returned uid=0(root) gid=0(root) groups=0(root) \u2014 despite allow_subprocess=False.\nopen(\u0027/etc/passwd\u0027).read() returned the real file contents in full \u2014 despite /etc/passwd being explicitly listed in blocked_paths.\nA shell command containing rm -rf actually created and then deleted a real test directory (confirmed via echo DELETED after the operation) \u2014 despite \"rm -rf\" being explicitly listed in blocked_commands.\n\nAll three were run against the same sandbox instance in one session, confirming simultaneous failure across the policy\u0027s command, path, and subprocess restrictions.\nImpact\nAny deployment relying on the default subprocess sandbox type \u2014 including via the API\u0027s own recommended strict() configuration for untrusted code \u2014 receives no actual protection against subprocess creation, sensitive file access, or destructive command execution. Since subprocess requires no extra dependencies and is the default Sandbox Config.sandbox_type, this is plausibly the active backend in many real deployments rather than an edge case.\nRoot cause\nSecurity Policy was designed as a backend-agnostic configuration surface, but only allow_network and max_output_size were ever wired into Subprocess Sandbox. The remaining fields exist as fully-documented configuration with no corresponding enforcement code in this backend.\nSuggested remediation\nEnforce blocked_commands/blocked_imports/blocked_paths/allow_subprocess/allow_file_write in Subprocess Sandbox before invoking the child process, or \u2014 given the well-known limits of denylist-style matching \u2014 default to the already-implemented native backend (Landlock/Seatbelt) for untrusted code rather than the unenforced subprocess backend. Consider having SecurityPolicy.strict() raise if instantiated against a backend that cannot enforce its fields.",
  "id": "GHSA-5r6c-gj4g-r697",
  "modified": "2026-10-08T21:58:11Z",
  "published": "2026-10-08T21:58:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60085"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62177"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-unenforced-security-policy-in-subprocess-sandbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend"
}

GHSA-5XVC-RWV8-86P7

Vulnerability from github – Published: 2024-03-26 21:30 – Updated: 2025-11-15 02:52
VLAI
Summary
Ignite Realtime Openfire privilege escalation vulnerability
Details

An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.igniterealtime.openfire:xmppserver"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-27T21:59:21Z",
    "nvd_published_at": "2024-03-26T21:15:52Z",
    "severity": "HIGH"
  },
  "details": "An issue in Ignite Realtime Openfire v.4.8.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component.",
  "id": "GHSA-5xvc-rwv8-86p7",
  "modified": "2025-11-15T02:52:34Z",
  "published": "2024-03-26T21:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25420"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/pull/2411"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/commit/5c022bfa82d71d1710381ab395b100cdbcb8f310"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/igniterealtime/Openfire"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/admin/AdminManager.java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/igniterealtime/Openfire/releases/tag/v4.8.1"
    },
    {
      "type": "WEB",
      "url": "https://igniterealtime.atlassian.net/browse/OF-2758"
    },
    {
      "type": "WEB",
      "url": "https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421"
    },
    {
      "type": "WEB",
      "url": "https://www.igniterealtime.org/projects/openfire"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ignite Realtime Openfire privilege escalation vulnerability"
}

GHSA-65C8-R727-2MPJ

Vulnerability from github – Published: 2026-07-15 12:32 – Updated: 2026-10-08 21:58
Withdrawn 2026-10-08 VLAI
Summary
Duplicate Advisory: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5r6c-gj4g-r697. This link is maintained to preserve external references.

Original Description

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.6.77"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T21:58:05Z",
    "nvd_published_at": "2026-07-15T12:18:17Z",
    "severity": "HIGH"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5r6c-gj4g-r697. This link is maintained to preserve external references.\n\n### Original Description\nPraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy configuration.",
  "id": "GHSA-65c8-r727-2mpj",
  "modified": "2026-10-08T21:58:05Z",
  "published": "2026-07-15T12:32:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5r6c-gj4g-r697"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60085"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-unenforced-security-policy-in-subprocess-sandbox"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend",
  "withdrawn": "2026-10-08T21:58:05Z"
}

GHSA-66VJ-HXH5-X3JH

Vulnerability from github – Published: 2024-09-17 18:33 – Updated: 2025-10-22 00:33
VLAI
Details

The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-38813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250",
      "CWE-273"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-17T18:15:04Z",
    "severity": "HIGH"
  },
  "details": "The vCenter Server contains a privilege escalation vulnerability.\u00a0A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.",
  "id": "GHSA-66vj-hxh5-x3jh",
  "modified": "2025-10-22T00:33:06Z",
  "published": "2024-09-17T18:33:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38813"
    },
    {
      "type": "WEB",
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38813"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6MM6-PP6H-9P36

Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34
VLAI
Details

Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

Severity
8.1 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-16466"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-30T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.",
  "id": "GHSA-6mm6-pp6h-9p36",
  "modified": "2022-05-13T01:34:06Z",
  "published": "2022-05-13T01:34:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16466"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/388515"
    },
    {
      "type": "WEB",
      "url": "https://nextcloud.com/security/advisory/?id=NC-SA-2018-010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-748R-5R8Q-273M

Vulnerability from github – Published: 2022-07-07 00:00 – Updated: 2023-09-05 20:16
VLAI
Summary
Apache Superset allows authenticated users to access metadata they have no permission to
Details

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-37839"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-15T21:31:23Z",
    "nvd_published_at": "2022-07-06T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.",
  "id": "GHSA-748r-5r8q-273m",
  "modified": "2023-09-05T20:16:04Z",
  "published": "2022-07-07T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37839"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/superset/commit/2bd89d1705347da5446902a3f65eb8d0a6353503"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/superset"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Superset allows authenticated users to access metadata they have no permission to"
}

GHSA-78XR-CMR3-FXQ9

Vulnerability from github – Published: 2025-01-17 21:31 – Updated: 2025-03-04 15:31
VLAI
Details

Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-21399"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273",
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-17T20:15:46Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability",
  "id": "GHSA-78xr-cmr3-fxq9",
  "modified": "2025-03-04T15:31:46Z",
  "published": "2025-01-17T21:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21399"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21399"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-detection-script"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/elevation-of-privilege-vulnerability-in-microsoft-edge-chromium-based-mitigation-script"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-7FPJ-9HR8-28VH

Vulnerability from github – Published: 2024-04-17 18:25 – Updated: 2024-11-18 17:28
VLAI
Summary
Keycloak vulnerable to impersonation via logout token exchange
Details

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Severity
3.4 (Low)
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-services"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "22.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-services"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "23.0.0"
            },
            {
              "fixed": "24.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273",
      "CWE-284",
      "CWE-287",
      "CWE-290",
      "CWE-347"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-17T18:25:59Z",
    "nvd_published_at": "2024-11-17T11:15:05Z",
    "severity": "LOW"
  },
  "details": "Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.\n\n",
  "id": "GHSA-7fpj-9hr8-28vh",
  "modified": "2024-11-18T17:28:39Z",
  "published": "2024-04-17T18:25:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-7fpj-9hr8-28vh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0657"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:1867"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:1868"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-0657"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166728"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak vulnerable to impersonation via logout token exchange"
}

GHSA-86FH-J58M-7PF5

Vulnerability from github – Published: 2021-11-23 17:57 – Updated: 2024-01-31 15:13
VLAI
Summary
Improper Privilege Management in Apache Ozone
Details

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.ozone:ozone-main"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-36372"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-273"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-22T19:04:02Z",
    "nvd_published_at": "2021-11-19T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.",
  "id": "GHSA-86fh-j58m-7pf5",
  "modified": "2024-01-31T15:13:11Z",
  "published": "2021-11-23T17:57:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36372"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/ozone"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/11/19/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Privilege Management in Apache Ozone"
}
Mitigation MIT-46
Architecture and Design

Strategy: Separation of Privilege

  • Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
  • Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-53
Implementation

Check the results of all functions that return a value and verify that the value is expected.

Mitigation
Implementation

In Windows, make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003). Code that relies on impersonation for security must ensure that the impersonation succeeded, i.e., that a proper privilege demotion happened.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list