CWE-689: Permission Race Condition During Resource Copy
Filter
The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.
What the weakness is: CWE-689 at MITRE. All weaknesses
Related attack patterns (CAPEC): 2
- CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
- CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-689, as MITRE names them. Credits.
Ask an AI about CWE-689
Show the prompt
Explain CWE-689: Permission Race Condition During Resource Copy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/689.html and https://cve.bz/cve/cwe/689?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.1CVE-2025-0087EPSS 0.2%
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User i…
- 5.9CVE-2025-40909EPSS 0.5%
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone …
- 7.8CVE-2022-28768EPSS 0.2%
The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process…