Common Weakness Enumeration
CWE-281
AllowedImproper Preservation of Permissions
Abstraction: Base · Status: Draft
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
437 vulnerabilities reference this CWE, most recent first.
GHSA-XH6M-7CR7-XX66
Vulnerability from github – Published: 2024-02-27 21:54 – Updated: 2025-05-30 12:36
VLAI
Summary
Missing permission checks on Hazelcast client protocol
Details
Impact
In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.
Patches
Fix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1
Workarounds
There is no known workaround.
Severity
7.6 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.0"
},
{
"last_affected": "5.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.1"
},
{
"last_affected": "5.1.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.4"
},
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.2.0"
},
{
"fixed": "5.2.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "5.3.0"
},
{
"fixed": "5.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-all"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.hazelcast:hazelcast-all"
},
"ranges": [
{
"events": [
{
"introduced": "4.2"
},
{
"last_affected": "4.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45859"
],
"database_specific": {
"cwe_ids": [
"CWE-281",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-27T21:54:15Z",
"nvd_published_at": "2024-02-28T22:15:26Z",
"severity": "HIGH"
},
"details": "### Impact\nIn Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don\u0027t check permissions properly, allowing authenticated users to access data stored in the cluster.\n\n### Patches\nFix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1\n\n### Workarounds\nThere is no known workaround.",
"id": "GHSA-xh6m-7cr7-xx66",
"modified": "2025-05-30T12:36:04Z",
"published": "2024-02-27T21:54:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45859"
},
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast/pull/25509"
},
{
"type": "PACKAGE",
"url": "https://github.com/hazelcast/hazelcast"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Missing permission checks on Hazelcast client protocol"
}
GHSA-XJC5-M98P-6F2C
Vulnerability from github – Published: 2023-11-28 15:30 – Updated: 2026-02-23 09:31
VLAI
Details
Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before 23.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-6239"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-28T14:15:07Z",
"severity": "MODERATE"
},
"details": "Improperly calculated effective permissions in M-Files Server versions 23.9 and 23.10 and 23.11 before\u00a023.11.13168.7 could produce a faulty result if an object used a specific configuration of metadata-driven permissions.",
"id": "GHSA-xjc5-m98p-6f2c",
"modified": "2026-02-23T09:31:18Z",
"published": "2023-11-28T15:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6239"
},
{
"type": "WEB",
"url": "https://empower.m-files.com/security-advisories/CVE-2023-6239"
},
{
"type": "WEB",
"url": "https://product.m-files.com/security-advisories/cve-2023-6239"
},
{
"type": "WEB",
"url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-6239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPM2-F32F-Q35F
Vulnerability from github – Published: 2024-12-07 00:31 – Updated: 2024-12-12 03:33
VLAI
Details
Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.
Severity
7.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-41648"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T22:15:20Z",
"severity": "HIGH"
},
"details": "Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a crafted script to the nav2_regulated_pure_pursuit_controller.",
"id": "GHSA-xpm2-f32f-q35f",
"modified": "2024-12-12T03:33:00Z",
"published": "2024-12-07T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41648"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/issues/4438"
},
{
"type": "WEB",
"url": "https://github.com/ros-navigation/navigation2/pull/4463"
},
{
"type": "WEB",
"url": "https://github.com/GoesM/ROS-CVE-CNVDs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQF3-Q69C-JC7C
Vulnerability from github – Published: 2024-12-10 21:30 – Updated: 2024-12-11 18:30
VLAI
Details
Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-50931"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-10T19:15:30Z",
"severity": "MODERATE"
},
"details": "Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.",
"id": "GHSA-xqf3-q69c-jc7c",
"modified": "2024-12-11T18:30:42Z",
"published": "2024-12-10T21:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50931"
},
{
"type": "WEB",
"url": "https://github.com/CNK2100/2024-CVE/blob/main/README.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQMF-WF6X-2CX6
Vulnerability from github – Published: 2022-11-11 19:00 – Updated: 2022-11-17 18:30
VLAI
Details
Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-26024"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-11T16:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control in the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN and NUC7i7DN before version 1.78.2.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-xqmf-wf6x-2cx6",
"modified": "2022-11-17T18:30:30Z",
"published": "2022-11-11T19:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26024"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00689.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRVP-GX9P-8CH2
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31
VLAI
Details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-27795"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:47Z",
"severity": "HIGH"
},
"details": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.",
"id": "GHSA-xrvp-gx9p-8ch2",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27795"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XXMH-66CH-6MV4
Vulnerability from github – Published: 2025-02-01 00:31 – Updated: 2025-02-03 21:31
VLAI
Details
EasyVirt DCScope <=8.6.0 and CO2Scope <=1.3.0 are vulnerable to Incorrect Access Control. This vulnerability allows the api to be used to create/modify/delete information about aliases (users) / users (groups) / roles.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2024-53355"
],
"database_specific": {
"cwe_ids": [
"CWE-281"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-31T22:15:09Z",
"severity": "HIGH"
},
"details": "EasyVirt DCScope \u003c=8.6.0 and CO2Scope \u003c=1.3.0 are vulnerable to Incorrect Access Control. This vulnerability allows the api to be used to create/modify/delete information about aliases (users) / users (groups) / roles.",
"id": "GHSA-xxmh-66ch-6mv4",
"modified": "2025-02-03T21:31:49Z",
"published": "2025-02-01T00:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53355"
},
{
"type": "WEB",
"url": "https://github.com/Elymaro/CVE/blob/main/EasyVirt/CVE-2024-53355.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.