CWE-276
AllowedIncorrect Default Permissions
Abstraction: Base · Status: Draft
During installation, installed file permissions are set to allow anyone to modify those files.
2034 vulnerabilities reference this CWE, most recent first.
GHSA-4GX8-M984-9P5Q
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-02-01 15:30In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703780
{
"affected": [],
"aliases": [
"CVE-2022-20456"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-770"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-26T21:15:00Z",
"severity": "HIGH"
},
"details": "In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703780",
"id": "GHSA-4gx8-m984-9p5q",
"modified": "2023-02-01T15:30:19Z",
"published": "2023-01-26T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20456"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4H6F-CCW6-MHHR
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-07-13 00:00In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-166125765
{
"affected": [],
"aliases": [
"CVE-2020-0485"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-15T16:15:00Z",
"severity": "HIGH"
},
"details": "In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-166125765",
"id": "GHSA-4h6f-ccw6-mhhr",
"modified": "2022-07-13T00:00:42Z",
"published": "2022-05-24T17:36:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0485"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2020-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4HC4-PGFX-3MRX
Vulnerability from github – Published: 2023-03-17 18:20 – Updated: 2023-03-17 21:38Impact
An attacker with access to a Cilium agent pod can write to /opt/cni/bin due to a hostPath mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node.
Patches
The issue has been fixed and is available on versions >=1.11.15, >=1.12.8, >=1.13.1.
Workarounds
Kubernetes RBAC should be used to deny users and service accounts exec access to Cilium agent pods.
In cases where a user requires exec access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.
References
Acknowledgements
The Cilium community has worked together with members of Isovalent and Form3 to prepare these mitigations. Special thanks to Anastasios Koutlis, Daniel Teixeira, and Magdalena Oczadly for their cooperation.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cilium/cilium"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/cilium/cilium"
},
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/cilium/cilium"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-27593"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-17T18:20:46Z",
"nvd_published_at": "2023-03-17T20:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nAn attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. \n\n### Patches\n\nThe issue has been fixed and is available on versions \u003e=1.11.15, \u003e=1.12.8, \u003e=1.13.1.\n\n### Workarounds\n\n[Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) should be used to deny users and service accounts `exec` access to Cilium agent pods.\n\nIn cases where a user requires `exec` access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.\n\n### References\n\n* [PR containing resolution](https://github.com/cilium/cilium/pull/24075)\n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent and Form3 to prepare these mitigations. Special thanks to Anastasios Koutlis, Daniel Teixeira, and Magdalena Oczadly for their cooperation. \n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority. ",
"id": "GHSA-4hc4-pgfx-3mrx",
"modified": "2023-03-17T21:38:36Z",
"published": "2023-03-17T18:20:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-4hc4-pgfx-3mrx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27593"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/pull/24075"
},
{
"type": "PACKAGE",
"url": "https://github.com/cilium/cilium"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/releases/tag/v1.11.15"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/releases/tag/v1.12.8"
},
{
"type": "WEB",
"url": "https://github.com/cilium/cilium/releases/tag/v1.13.1"
},
{
"type": "WEB",
"url": "https://kubernetes.io/docs/reference/access-authn-authz/rbac"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "cilium-agent container can access the host via `hostPath` mount"
}
GHSA-4HGF-JJP9-HFQ5
Vulnerability from github – Published: 2025-08-26 15:31 – Updated: 2025-08-26 15:31The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Cursor, potentially disguising attacker's malicious intent.
This issue was detected in 15.4.1 version of Cursor. Project maintainers decided not to fix this issue, because a scenario including a local attacker falls outside their defined threat model.
{
"affected": [],
"aliases": [
"CVE-2025-9190"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-26T13:15:33Z",
"severity": "MODERATE"
},
"details": "The configuration of Cursor on macOS, specifically the \"RunAsNode\" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Cursor TCC (Transparency, Consent, and Control) permissions. \nAcquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Cursor, potentially disguising attacker\u0027s malicious intent. \n\nThis issue was detected in 15.4.1 version of Cursor. Project maintainers decided not to fix this issue, because a scenario including a local attacker falls outside their defined threat model.",
"id": "GHSA-4hgf-jjp9-hfq5",
"modified": "2025-08-26T15:31:01Z",
"published": "2025-08-26T15:31:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cursor/cursor/security/advisories/GHSA-xp8w-f7f4-r544"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9190"
},
{
"type": "WEB",
"url": "https://afine.com/threat-of-tcc-bypasses-on-macos/#cooking-cursor-app"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2025/08/tcc-bypass"
},
{
"type": "WEB",
"url": "https://github.com/cursor/cursor"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4HJ2-R2PM-3HC6
Vulnerability from github – Published: 2022-04-22 20:42 – Updated: 2022-04-28 18:10Impact
A bug was found in CRI-O where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.
This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Patches
This bug will been fixed in the following versions of CRI-O: - v1.24.0
Users should update to the version corresponding to their minor release as soon as possible. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset.
This fix changes CRI-O behavior such that containers are started with a more typical Linux environment. Refer to capabilities(7) for a description of how capabilities work. Note that permitted file capabilities continue to allow for privileges to be raised up to the container's bounding set and that processes may add capabilities to their own inheritable set up to the container's bounding set per the rules described in the manual page. In all cases the container's bounding set provides an upper bound on the capabilities that can be assumed and provides for the container security sandbox.
Workarounds
The entrypoint of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.
Credits
CRI-O would like to thank Andrew G. Morgan for responsibly disclosing this issue, as well as the Moby (Docker Engine) project for working with the other container engines in coordinating a fix.
For more information
If you have any questions or comments about this advisory:
- Open an issue
- Email us at cncf-crio-security@lists.cncf.io if you think you’ve found a security bug
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 4.8/Medium
| Metric | Value | Comments |
|---|---|---|
| Attack Vector (AV) | Local | An attacker requires local control to launch a container with files that have inheritable capabilities. |
| Attack Complexity (AC) | Low | Modifying a file to have inheritable capabilities is not difficult. |
| Privileges Required (PR) | Low | An attacker requires enough privilege to cause a container to be launched with a compromised image. Moby's API is typically bound to a local Unix domain socket and requires calls to be made from a process that is either UID 0 or present in the configured group. |
| User Interaction (UI) | Required | An attacker must cause the compromised image to be run. |
| Scope (S) | Unchanged | The container boundary set by Moby, including the bounding capability set, is not modified. A successful attack gains access to privileges and resources within the boundary, not outside of it. |
| Confidentiality (C) | Low | An attacker may gain access to some confidential information through elevation of CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_SETFCAP, or CAP_SETPCAP, but the exposed information is limited to that which is already inside the container. |
| Integrity (I) | Low | An attacker may be able to tamper with data inside the container through elevation of CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_SETFCAP, or CAP_SETPCAP, or spoof packets with CAP_NET_RAW, but the tampered data is limited to that which is already inside the container. |
| Availability (A) | Low | An attacker may be able to affect the availability of an application running inside the container through elevation of CAP_KILL or CAP_NET_RAW, or may be able to affect availability through tampering with file dependencies. |
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cri-o/cri-o"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.24.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-27652"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-22T20:42:46Z",
"nvd_published_at": "2022-04-18T17:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA bug was found in CRI-O where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during `execve(2)`. Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container\u0027s bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.\n\nThis bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container\u0027s bounding set.\n\n\n### Patches\n\nThis bug will been fixed in the following versions of CRI-O:\n- v1.24.0\n\nUsers should update to the version corresponding to their minor release as soon as possible. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset.\n\nThis fix changes CRI-O behavior such that containers are started with a more typical Linux environment. Refer to `capabilities(7)` for a description of how capabilities work. Note that permitted file capabilities continue to allow for privileges to be raised up to the container\u0027s bounding set and that processes may add capabilities to their own inheritable set up to the container\u0027s bounding set per the rules described in the manual page. In all cases the container\u0027s bounding set provides an upper bound on the capabilities that can be assumed and provides for the container security sandbox.\n\n### Workarounds\n\nThe entrypoint of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting.\n\n### Credits\n\nCRI-O would like to thank [Andrew G. Morgan](https://github.com/AndrewGMorgan) for responsibly disclosing this issue, as well as the Moby (Docker Engine) project for working with the other container engines in coordinating a fix.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* [Open an issue](https://github.com/cri-o/cri-o/issues/new)\n* Email us at [cncf-crio-security@lists.cncf.io](cncf-crio-security@lists.cncf.io) if you think you\u2019ve found a security bug\n\n------------------\n\nhttps://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L\n4.8/Medium\n\n|Metric\t|Value\t|Comments\t|\n|---\t|---\t|---\t|\n|Attack Vector (AV)\t|Local\t|An attacker requires local control to launch a container with files that have inheritable capabilities. \t|\n|Attack Complexity (AC)\t|Low\t|Modifying a file to have inheritable capabilities is not difficult.\t|\n|Privileges Required (PR)\t|Low\t|An attacker requires enough privilege to cause a container to be launched with a compromised image. Moby\u0027s API is typically bound to a local Unix domain socket and requires calls to be made from a process that is either UID 0 or present in the configured group.\t|\n|User Interaction (UI)\t|Required\t|An attacker must cause the compromised image to be run.\t|\n|Scope (S)\t|Unchanged\t|The container boundary set by Moby, including the bounding capability set, is not modified. A successful attack gains access to privileges and resources within the boundary, not outside of it.\t|\n|Confidentiality (C)\t|Low\t|An attacker may gain access to some confidential information through elevation of CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_SETFCAP, or CAP_SETPCAP, but the exposed information is limited to that which is already inside the container.\t|\n|Integrity (I)\t|Low\t|An attacker may be able to tamper with data inside the container through elevation of CAP_CHOWN, CAP_DAC_OVERRIDE, CAP_FOWNER, CAP_SETFCAP, or CAP_SETPCAP, or spoof packets with CAP_NET_RAW, but the tampered data is limited to that which is already inside the container.\t|\n|Availability (A)\t|Low\t|An attacker may be able to affect the availability of an application running inside the container through elevation of CAP_KILL or CAP_NET_RAW, or may be able to affect availability through tampering with file dependencies.\t|\n\n",
"id": "GHSA-4hj2-r2pm-3hc6",
"modified": "2022-04-28T18:10:23Z",
"published": "2022-04-22T20:42:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27652"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066839"
},
{
"type": "PACKAGE",
"url": "https://github.com/cri-o/cri-o"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Default Permissions in CRI-O"
}
GHSA-4HRM-834J-J4F9
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:19Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.
{
"affected": [],
"aliases": [
"CVE-2019-17365"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-09T22:15:00Z",
"severity": "HIGH"
},
"details": "Nix through 2.3 allows local users to gain access to an arbitrary user\u0027s account because the parent directory of the user-profile directories is world writable.",
"id": "GHSA-4hrm-834j-j4f9",
"modified": "2024-04-04T02:19:19Z",
"published": "2022-05-24T16:58:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17365"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/10/09/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/10/10/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/10/17/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4J28-Q9M7-3FMJ
Vulnerability from github – Published: 2022-12-12 15:30 – Updated: 2022-12-19 18:30A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that customers uninstall HP Jumpstart and use myHP software.
{
"affected": [],
"aliases": [
"CVE-2022-1038"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-12T13:15:00Z",
"severity": "HIGH"
},
"details": "A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that customers uninstall HP Jumpstart and use myHP software.",
"id": "GHSA-4j28-q9m7-3fmj",
"modified": "2022-12-19T18:30:25Z",
"published": "2022-12-12T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1038"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_6189329-6189528-16/hpsbhf03791"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4J72-4WP3-2Q84
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-05-24 19:21Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2020-8741"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-17T20:15:00Z",
"severity": "HIGH"
},
"details": "Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-4j72-4wp3-2q84",
"modified": "2022-05-24T19:21:01Z",
"published": "2022-05-24T19:21:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8741"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00393.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4JHW-C53W-W5R7
Vulnerability from github – Published: 2025-03-21 18:31 – Updated: 2025-03-24 16:04Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/pipe-cd/pipecd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.49.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-53351"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-284",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T22:03:03Z",
"nvd_published_at": "2025-03-21T17:15:38Z",
"severity": "HIGH"
},
"details": "Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account\u0027s token, leading to escalation of privileges.",
"id": "GHSA-4jhw-c53w-w5r7",
"modified": "2025-03-24T16:04:17Z",
"published": "2025-03-21T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53351"
},
{
"type": "WEB",
"url": "https://gist.github.com/HouqiyuA/948a808b8bd48b17b37a4d5e0b6fb005"
},
{
"type": "PACKAGE",
"url": "https://github.com/pipe-cd/pipecd"
},
{
"type": "WEB",
"url": "https://pipecd.dev"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "PipeCD Vulnerable to Privilege Escalation"
}
GHSA-4M65-JVH6-7FH3
Vulnerability from github – Published: 2022-05-24 16:57 – Updated: 2024-04-04 02:06atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.
{
"affected": [],
"aliases": [
"CVE-2019-17054"
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-01T14:15:00Z",
"severity": "LOW"
},
"details": "atalk_create in net/appletalk/ddp.c in the AF_APPLETALK network module in the Linux kernel through 5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka CID-6cc03e8aa36c.",
"id": "GHSA-4m65-jvh6-7fh3",
"modified": "2024-04-04T02:06:34Z",
"published": "2022-05-24T16:57:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17054"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0edc3f703f7bcaf550774b5d43ab727bcd0fe06b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cc03e8aa36c51f3b26a0d21a3c4ce2809c842ac"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00013.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JNEWGIK7QA24OIUUL67QZNJN52NB7T"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Nov/11"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4184-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4185-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4185-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4186-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4186-2"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
The architecture needs to access and modification attributes for files to only those users who actually require those actions.
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.