CWE-412
Unrestricted Externally Accessible Lock
Description
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-25
CVEs mapped to this weakness (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-18269 | Cri | 0.64 | 9.8 | 0.01 | Dec 16, 2019 | Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. | ||
| CVE-2023-22318 | Hig | 0.49 | 7.5 | 0.01 | May 15, 2023 | Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5. | ||
| CVE-2026-25612 | Med | 0.42 | 6.5 | 0.00 | Feb 10, 2026 | The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks. | ||
| CVE-2019-11485 | Low | 0.21 | 3.3 | 0.00 | Feb 8, 2020 | Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling. | ||
| CVE-2026-62426 | Hig | 0.00 | 8.8 | 0.00 | Jul 28, 2026 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not… | ||
| CVE-2023-38505 | Hig | 0.00 | 7.5 | 0.01 | Jul 27, 2023 | DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshake, and will stay… |
- risk 0.64cvss 9.8epss 0.01
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.
- risk 0.49cvss 7.5epss 0.01
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.
- risk 0.42cvss 6.5epss 0.00
The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conflicting locks.
- risk 0.21cvss 3.3epss 0.00
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
- risk 0.00cvss 8.8epss 0.00
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not…
- risk 0.00cvss 7.5epss 0.01
DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handshake, and will stay…