cve.bz

CWE-276: Incorrect Default Permissions, page 23

Filter

During installation, installed file permissions are set to allow anyone to modify those files.

What the weakness is: CWE-276 at MITRE

Ask an AI about CWE-276

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-276: Incorrect Default Permissions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/276.html and https://cve.bz/cve/cwe/276?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2021-42098EPSS 1.8%

    An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell.

  2. 8.8CVE-2021-29005EPSS 2.2%

    Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server.

  3. 4.3CVE-2021-39886EPSS 0.6%

    Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references.

  4. 5.5CVE-2021-33923EPSS 0.3%

    Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).

  5. 9.8CVE-2021-36365EPSS 3.8%

    Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.

  6. 9.8CVE-2021-36363EPSS 3.8%

    Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.

  7. 7.8CVE-2021-20037EPSS 0.4%

    SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalation which potentially allows command execution in the host operating system. This vulnerability impa…

  8. 5.5CVE-2021-1832EPSS 0.9%

    Copied files may not have the expected file permissions. This issue is fixed in Security Update 2021-002 Catalina, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. The issue was addressed with improved permissions logi…

  9. 5.5CVE-2021-1831EPSS 1.0%

    The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may allow shortcuts to access restricted files.

  10. 5.5CVE-2021-30750EPSS 0.8%

    The issue was addressed with improved permissions logic. This issue is fixed in macOS Big Sur 11.3. A malicious application may be able to access the user's recent contacts.

  11. 5.5CVE-2021-31007EPSS 0.9%

    Description: A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.1 and iPadOS 15.1, tvOS 15.1, macOS Big Sur 11.6.2, watchOS 8.1, macOS Monterey 12.1. A malicious application may be able to bypass Priv…

  12. 5.5CVE-2021-31006EPSS 0.8%

    Description: A permissions issue was addressed with improved validation. This issue is fixed in watchOS 7.6, tvOS 14.7, macOS Big Sur 11.5. A malicious application may be able to bypass certain Privacy preferences.

  13. 3.3CVE-2021-31000EPSS 0.7%

    A permissions issue was addressed with improved validation. This issue is fixed in iOS 15.2 and iPadOS 15.2, watchOS 8.3, macOS Monterey 12.1, tvOS 15.2. A malicious application may be able to read sensitive contact information.

  14. 4.3CVE-2021-30999EPSS 0.5%

    The issue was addressed with improved permissions logic. This issue is fixed in iOS 14.6 and iPadOS 14.6. A user may be unable to fully delete browsing history.

  15. 9.8CVE-2021-39274EPSS 3.1%

    In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary co…

  16. 8.8CVE-2021-39273EPSS 2.7%

    In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to modify the application, modules, and configuration files. This leads to arbitrary code execution wi…

  17. 5.3CVE-2021-37351EPSS 2.8%

    Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.

  18. 7.8CVE-2021-35312ExploitEPSS 1.1%

    A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. The Amica Prodigy's executable "RemoteBackup.Service.exe" has incorrect permissions, allowing a local unprivileged user to replace it with a malicious file that will be…

  19. 7.8CVE-2021-36795EPSS 0.2%

    A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivileged linux user, if certain environment criteria are met, can gain additional privi…

  20. 5.5CVE-2021-22295EPSS 0.1%

    A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.

  21. 7.8CVE-2021-32464EPSS 0.6%

    An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security Services could allow an attacker to modify a specific script before it is executed. Pleas…

  22. 4.3CVE-2021-33334EPSS 0.9%

    The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7.2 before fix pack 6, does not properly check user permissions, which allows remote attackers with …

  23. 6.3CVE-2021-33333EPSS 0.8%

    The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 before fix pack 6, does not properly check user permission, which allows remote authenticated users to v…

  24. 4.3CVE-2021-33327EPSS 0.9%

    The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.2 before fix pack 8, does not properly check user permission, which allows remote authenticated use…

  25. 4.3CVE-2021-33324EPSS 0.9%

    The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properly check permission of pages, which allows remote authenticated users without view permission of a p…

  26. 8.8CVE-2020-5353EPSS 1.0%

    The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifi…

  27. 8.8CVE-2020-26180EPSS 0.6%

    Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data s…

  28. 4.4CVE-2020-29503EPSS 0.2%

    Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the information disclosure of certain system directory.

  29. 6.7CVE-2020-25593EPSS 0.2%

    Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.

  30. 7.8CVE-2021-0486EPSS 0.1%

    In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction …

  31. 7.3CVE-2021-0441EPSS 0.1%

    In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation…

  32. 9.1CVE-2021-31217EPSS 4.0%

    In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM.

  33. 5.3CVE-2021-32725EPSS 1.2%

    Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in ver…

  34. 6.1CVE-2021-33214EPSS 0.6%

    In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive information disclosure, modification of configuration files, or disruption of normal system operation.

  35. 7.1CVE-2021-26274EPSS 0.4%

    The Agent in NinjaRMM 5.0.909 has Insecure Permissions.

  36. 5.3CVE-2021-22346EPSS 0.5%

    There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may lead to the disclosure of user habits.

  37. 7.5CVE-2021-22368EPSS 0.6%

    There is a Permission Control Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect normal use of the device.

  38. 7.5CVE-2021-22371EPSS 0.7%

    There is an Improper Permission Management Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may affect service confidentiality.

  39. 5.5CVE-2021-20490EPSS 0.2%

    IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settings. IBM X-Force ID: 197791.

  40. 7.5CVE-2021-21737EPSS 0.8%

    A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could use this vulnerability to tamper with the system desktop and affect system custo…

  41. 4.2CVE-2021-34395EPSS 0.2%

    Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privileges, which might lead to limited information disclosure, a low risk of modifcation…

  42. 6.7CVE-2021-34387EPSS 0.2%

    The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRAM reserved for TrustZone is identity-mapped by TLK with read, write, and execute permissions, which…

  43. 7.8CVE-2021-0143EPSS 0.2%

    Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access.

  44. 7.8CVE-2021-31998EPSS 0.3%

    A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2 allows local attackers to escalate their privileges from the news user to root.…

  45. 7.2CVE-2021-21736EPSS 0.9%

    A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camer…

  46. 7.8CVE-2021-0106EPSS 0.2%

    Incorrect default permissions in the Intel(R) Optane(TM) DC Persistent Memory for Windows software versions before 2.00.00.3842 or 1.00.00.3515 may allow an authenticated user to potentially enable escalation of privilege via local access.

  47. 7.8CVE-2021-0100EPSS 0.2%

    Incorrect default permissions in the installer for the Intel(R) SSD Data Center Tool, versions downloaded before 12/31/2020, may allow an authenticated user to potentially enable escalation of privilege via local access.

  48. 7.8CVE-2021-0058EPSS 0.2%

    Incorrect default permissions in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  49. 7.8CVE-2020-27384EPSS 0.3%

    The Gw2-64.exe in Guild Wars 2 launcher version 106916 suffers from an elevation of privileges vulnerability which can be used by an "Authenticated User" to modify the existing executable file with a binary of his choice. The vulnerability…

  50. 7.8CVE-2021-27032EPSS 0.2%

    Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. A malicious user with limited privileges could run any number of tools on a system to identify services that are configured with weak permissions and a…