cve.bz

CWE-250: Execution with Unnecessary Privileges, page 8

Filter

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

What the weakness is: CWE-250 at MITRE. All weaknesses

Related attack patterns (CAPEC): 3
  • CAPEC-69 Target Programs with Elevated Privileges Likelihood: High · Severity: Very High
  • CAPEC-104 Cross Zone Scripting Likelihood: Medium · Severity: High
  • CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-250, as MITRE names them. Credits.

Ask an AI about CWE-250

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-250: Execution with Unnecessary Privileges and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/250.html and https://cve.bz/cve/cwe/250?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2021-3101EPSS 0.4%

    Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.

  2. 8.8CVE-2021-3100EPSS 0.4%

    The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.

  3. 6.7CVE-2022-20676EPSS 0.3%

    A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root-level privileges. This vulnerability is due to insufficient in…

  4. 7.8CVE-2022-27578EPSS 0.3%

    An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated or low privilege users can modify its content.

  5. 7.8CVE-2022-24113EPSS 0.2%

    Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windows) before build 27147, Acronis Cyber Prot…

  6. 7.8CVE-2021-36339EPSS 0.2%

    The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get privileged access to the virtual appliance.

  7. 8.8CVE-2022-21699EPSS 0.7%

    IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerabili…

  8. 7.8CVE-2021-34998EPSS 0.4%

    This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to…

  9. 7.8CVE-2021-1118EPSS 0.4%

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged operations by the guest OS, which may lead to information disclosure, data tampering, escalation of …

  10. 7.8CVE-2021-3576EPSS 0.9%

    Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of …

  11. 9.8CVE-2021-41035EPSS 1.8%

    In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.

  12. 8.8CVE-2021-37174EPSS 1.2%

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCOM ROX RX1500 (All versions < V2.14.1), RUGGEDCOM ROX RX1501 (All versions < V2.14.1), RUGGEDCOM RO…

  13. 8.8CVE-2021-1579EPSS 2.1%

    A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an authenticated, remote attacker with Administrator read…

  14. 7.8CVE-2021-25653EPSS 0.6%

    A privilege escalation vulnerability was discovered in Avaya Aura Appliance Virtualization Platform Utilities (AVPU) that may potentially allow a local user to escalate privileges. Affects 8.0.0.0 through 8.1.3.1 versions of AVPU.

  15. 7.8CVE-2021-25651EPSS 0.5%

    A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges. Affects all 7.x versions of Avaya Aura Utility Services

  16. 8.8CVE-2021-25650EPSS 0.5%

    A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged user. Affects all 7.x versions of Avaya Aura Utility Services

  17. 7.8CVE-2021-1528EPSS 0.2%

    A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges on an affected system. This vulnerability exists because the affected software does not properly restrict access t…

  18. 4.2CVE-2020-27826EPSS 0.6%

    A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any …

  19. 5.5CVE-2021-0256EPSS 0.2%

    A sensitive information disclosure vulnerability in the mosquitto message broker of Juniper Networks Junos OS may allow a locally authenticated user with shell access the ability to read portions of sensitive files, such as the master.pass…

  20. 7.8CVE-2021-0255EPSS 0.2%

    A local privilege escalation vulnerability in ethtraceroute of Juniper Networks Junos OS may allow a locally authenticated user with shell access to escalate privileges and write to the local filesystem as root. ethtraceroute is shipped wi…

  21. 7.8CVE-2021-27454EPSS 0.2%

    The software performs an operation at a privilege level higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses on the Reason DR60 (all firmware versions prior to 02A04.1).

  22. 7.8CVE-2021-27448EPSS 0.2%

    A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1).

  23. 8.0CVE-2020-26278EPSS 0.7%

    Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacke…

  24. 7.8CVE-2021-0223EPSS 0.4%

    A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. telnetd.real is shipped with setuid permiss…

  25. 7.8CVE-2021-0204EPSS 0.3%

    A sensitive information disclosure vulnerability in delta-export configuration utility (dexp) of Juniper Networks Junos OS may allow a locally authenticated shell user the ability to create and read database files generated by the dexp uti…

  26. 7.8CVE-2020-14386EPSS 1.3%

    A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity.

  27. 7.8CVE-2020-10056EPSS 0.4%

    A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by …

  28. 6.8CVE-2020-10290EPSS 0.4%

    Universal Robots controller execute URCaps (zip files containing Java-powered applications) without any permission restrictions and a wide API that presents many primitives that can compromise the overall robot operations as demonstrated i…

  29. 8.8CVE-2020-14493EPSS 1.7%

    A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands.

  30. 6.3CVE-2020-2023EPSS 1.1%

    Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1…

  31. 3.3CVE-2019-15790EPSS 0.5%

    Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged us…

  32. 5.5CVE-2020-7252EPSS 0.5%

    Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.

  33. 7.8CVE-2019-16784EPSS 0.7%

    In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the c…

  34. 7.2CVE-2019-16767EPSS 0.8%

    The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)

  35. 7.8CVE-2019-16765EPSS 5.4%

    If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed …

  36. 7.8CVE-2019-10168EPSS 0.5%

    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain. Since v1.2.19, libv…

  37. 7.8CVE-2019-10167EPSS 0.5%

    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that pro…

  38. 7.7CVE-2019-10147EPSS 0.5%

    rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups during stage 2 (the actual environment in which the applications run). Compromised…

  39. 7.7CVE-2019-10145EPSS 0.5%

    rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering during stage 2 (the actual environment in which the applications run). Compromi…

  40. 7.7CVE-2019-10144EPSS 0.5%

    rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised…

  41. 7.0CVE-2019-10143EPSS 0.3%

    It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into wr…

  42. 4.7CVE-2018-16888EPSS 0.3%

    It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to w…

  43. 8.8CVE-2018-5413EPSS 1.3%

    Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation.

  44. 7.8CVE-2018-10853EPSS 0.5%

    A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user…

  45. 7.8CVE-2017-7518EPSS 0.7%

    A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB) being raised in the guest stack…

  46. 5.5CVE-2018-10872EPSS 0.5%

    A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are d…

  47. 5.3CVE-2018-10892EPSS 1.1%

    The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keybo…

  48. 8.8CVE-2018-10856EPSS 0.9%

    It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

  49. 7.8CVE-2018-1087EPSS 0.7%

    kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation …

  50. 8.8CVE-2018-8853EPSS 0.4%

    Philips Brilliance CT devices operate user functions from within a contained kiosk in a Microsoft Windows operating system. Windows boots by default with elevated Windows privileges, enabling a kiosk application, user, or an attacker to po…