cve.bz

CWE-269: Improper Privilege Management, page 53

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Related attack patterns (CAPEC): 3
  • CAPEC-58 Restful Privilege Elevation Likelihood: High · Severity: High
  • CAPEC-122 Privilege Abuse Likelihood: High · Severity: Medium
  • CAPEC-233 Privilege Escalation

The attack patterns MITRE's CAPEC relates to CWE-269, as MITRE names them. Credits.

Ask an AI about CWE-269

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2022-1901EPSS 0.5%

    In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview.

  2. 6.5CVE-2022-2568EPSS 1.0%

    A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser pri…

  3. 7.8CVE-2022-37025EPSS 0.2%

    An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user ga…

  4. 7.8CVE-2020-10728EPSS 0.2%

    A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their…

  5. 9.8CVE-2022-37002EPSS 0.5%

    The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows or run in the background.

  6. 7.2CVE-2022-31672EPSS 0.7%

    VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.

  7. 9.8CVE-2022-20361EPSS 1.2%

    In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges ne…

  8. 7.8CVE-2022-20360EPSS 0.2%

    In setChecked of SecureNfcPreferenceController.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed f…

  9. 7.8CVE-2022-20356EPSS 0.1%

    In shouldAllowFgsWhileInUsePermissionLocked of ActiveServices.java, there is a possible way to start foreground service from background due to improper input validation. This could lead to local escalation of privilege with no additional e…

  10. 8.8CVE-2022-20347EPSS 1.1%

    In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. This could lead to remote escalation of privilege in Bluetooth settings with no additional execution privileges needed. U…

  11. 9.8CVE-2022-20239EPSS 0.3%

    remap_pfn_range' here may map out of size kernel memory (for example, may map the kernel area), and because the 'vma->vm_page_prot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to …

  12. 6.5CVE-2022-35782EPSS 1.8%

    Azure Site Recovery Elevation of Privilege Vulnerability

  13. 6.5CVE-2022-35781EPSS 1.8%

    Azure Site Recovery Elevation of Privilege Vulnerability

  14. 6.5CVE-2022-35780EPSS 1.8%

    Azure Site Recovery Elevation of Privilege Vulnerability

  15. 6.5CVE-2022-35775EPSS 1.8%

    Azure Site Recovery Elevation of Privilege Vulnerability

  16. 4.9CVE-2022-35774EPSS 2.1%

    Azure Site Recovery Elevation of Privilege Vulnerability

  17. 7.8CVE-2022-35771EPSS 0.8%

    Windows Defender Credential Guard Elevation of Privilege Vulnerability

  18. 7.8CVE-2022-35768EPSS 1.1%

    Windows Kernel Elevation of Privilege Vulnerability

  19. 7.8CVE-2022-35765EPSS 0.5%

    Storage Spaces Direct Elevation of Privilege Vulnerability

  20. 7.8CVE-2022-35764EPSS 0.5%

    Storage Spaces Direct Elevation of Privilege Vulnerability

  21. 7.8CVE-2022-35763EPSS 0.5%

    Storage Spaces Direct Elevation of Privilege Vulnerability

  22. 7.8CVE-2022-35762EPSS 0.5%

    Storage Spaces Direct Elevation of Privilege Vulnerability

  23. 7.8CVE-2022-35761EPSS 4.1%

    Windows Kernel Elevation of Privilege Vulnerability

  24. 7.8CVE-2022-34706EPSS 0.4%

    Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability

  25. 7.8CVE-2022-34703EPSS 0.6%

    Windows Partition Management Driver Elevation of Privilege Vulnerability

  26. 7.8CVE-2022-34699EPSS 4.5%

    Windows Win32k Elevation of Privilege Vulnerability

  27. 8.8CVE-2022-34691EPSS 2.4%

    Active Directory Domain Services Elevation of Privilege Vulnerability

  28. 7.0CVE-2022-33646EPSS 0.4%

    Azure Batch Node Agent Elevation of Privilege Vulnerability

  29. 7.8CVE-2022-33640EPSS 0.6%

    System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

  30. 7.8CVE-2022-36833EPSS 0.2%

    Improper Privilege Management vulnerability in Game Optimizing Service prior to versions 3.3.04.0 in Android 10, and 3.5.04.8 in Android 11 and above allows local attacker to execute hidden function for developer by changing package name.

  31. 7.5CVE-2022-2498EPSS 0.9%

    An issue in pipeline subscriptions in GitLab EE affecting all versions from 12.8 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 triggered new pipelines with the person who created the tag as the pipeline creator instead of…

  32. 9.1CVE-2022-35243EPSS 0.7%

    In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode r…

  33. 6.7CVE-2022-33962EPSS 0.2%

    In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, certain iRules commands may allow an attacker to bypass the access control restrictions for a se…

  34. 4.3CVE-2022-35921EPSS 0.5%

    fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. U…

  35. 9.8CVE-2022-2317EPSS 1.4%

    The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter.

  36. 8.8CVE-2022-2273EPSS 1.2%

    The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escalate to a higher membership level by using a crafted POST request.

  37. 6.5CVE-2022-34338EPSS 0.7%

    IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types. IBM X-Force ID: 229962.

  38. 8.1CVE-2022-35291EPSS 0.7%

    Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Tim…

  39. 6.7CVE-2022-20907EPSS 0.2%

    Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an a…

  40. 6.7CVE-2022-20906EPSS 0.2%

    Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an a…

  41. 7.1CVE-2022-26113EPSS 0.3%

    An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may allow a local attacker to perform an arbitrary file write on the…

  42. 7.8CVE-2022-30526ExploitEPSS 1.1%

    A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FL…

  43. 6.7CVE-2022-26118EPSS 0.3%

    A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root…

  44. 6.8CVE-2022-34754EPSS 0.3%

    A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials. Affected Products: Acti9 PowerTag Link C (A9XELC10-A) (V1.7.5 and prior), Acti9 PowerTag Link C (A9XELC10-B) (…

  45. 7.8CVE-2022-33710EPSS 0.2%

    Improper input validation vulnerability in BillingPackageInsraller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.

  46. 7.8CVE-2022-33709EPSS 0.2%

    Improper input validation vulnerability in ApexPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.

  47. 7.8CVE-2022-33708EPSS 0.2%

    Improper input validation vulnerability in AppsPackageInstaller in Galaxy Store prior to version 4.5.41.8 allows local attackers to launch activities as Galaxy Store privilege.

  48. 8.2CVE-2022-23720EPSS 0.2%

    PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT administrator could mistakenly deploy administrator privileged PingID API credentials, su…

  49. 7.8CVE-2017-20121EPSS 0.4%

    A vulnerability was found in Teradici Management Console 2.2.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Database Management. The manipulation leads to improper privilege…

  50. 7.8CVE-2017-20112EPSS 0.4%

    A vulnerability has been found in IVPN Client 2.6.6120.33863 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument --up cmd leads to improper privilege management. The atta…