cve.bz

CWE-269: Improper Privilege Management, page 78

Filter

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

What the weakness is: CWE-269 at MITRE

Ask an AI about CWE-269

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-269: Improper Privilege Management and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/269.html and https://cve.bz/cve/cwe/269?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2002-0080EPSS 0.5%

    rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local users, who could then read certain files that would otherwise be disallowed.

  2. –CVE-2002-0049EPSS 13%

    Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.

  3. 8.4CVE-1999-0084EPSS 0.4%

    Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.