VYPR

CWE-732

Incorrect Permission Assignment for Critical Resource

ClassDraftLikelihood: High

Description

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.

Hierarchy (View 1000)

Related attack patterns (CAPEC)

CAPEC-1 · CAPEC-122 · CAPEC-127 · CAPEC-17 · CAPEC-180 · CAPEC-206 · CAPEC-234 · CAPEC-60 · CAPEC-61 · CAPEC-62 · CAPEC-642

CVEs mapped to this weakness (1,752)

page 87 of 88
  • CVE-2022-25010CriMar 1, 2022
    risk 0.00cvss 9.1epss 0.01

    The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.

  • CVE-2022-0532MedFeb 9, 2022
    risk 0.00cvss 4.2epss 0.01

    An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

  • CVE-2021-44512HigDec 7, 2021
    risk 0.00cvss 7.0epss 0.00

    World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.

  • CVE-2021-3706HigSep 15, 2021
    risk 0.00cvss 7.5epss 0.01

    adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag

  • CVE-2021-33586MedMay 27, 2021
    risk 0.00cvss 4.3epss 0.01

    InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.

  • CVE-2021-28168MedApr 22, 2021
    risk 0.00cvss 6.2epss 0.01

    Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the…

  • CVE-2020-29454MedDec 2, 2020
    risk 0.00cvss 4.3epss 0.01

    Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.

  • CVE-2020-29074HigNov 25, 2020
    risk 0.00cvss 8.8epss 0.02

    scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.

  • CVE-2020-28914HigNov 17, 2020
    risk 0.00cvss 7.1epss 0.00

    An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable…

  • CVE-2020-10781MedSep 16, 2020
    risk 0.00cvss 5.5epss 0.00

    A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This read allocates kernel memory and is not…

  • CVE-2020-24394HigAug 19, 2020
    risk 0.00cvss 7.1epss 0.00

    In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

  • CVE-2020-12831MedMay 13, 2020
    risk 0.00cvss 5.3epss 0.01

    An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and…

  • CVE-2020-5281MedMar 25, 2020
    risk 0.00cvss 6.2epss 0.01

    In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

  • CVE-2019-19882HigDec 18, 2019
    risk 0.00cvss 7.8epss 0.01

    shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing…

  • CVE-2019-5068MedNov 5, 2019
    risk 0.00cvss 4.4epss 0.00

    An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the shared memory without any specific permissions to trigger this vulnerability.

  • CVE-2019-12589HigJun 3, 2019
    risk 0.00cvss 8.8epss 0.01

    In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker.

  • CVE-2019-3893MedApr 9, 2019
    risk 0.00cvss 4.9epss 0.02

    In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this…

  • CVE-2018-20145HigDec 13, 2018
    risk 0.00cvss 7.5epss 0.02

    Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.

  • CVE-2018-12467MedAug 1, 2018
    risk 0.00cvss 6.0epss 0.01

    Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.

  • CVE-2018-12466MedAug 1, 2018
    risk 0.00cvss 4.4epss 0.01

    openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.