CWE-732: Incorrect Permission Assignment for Critical Resource, page 12
Filter
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
What the weakness is: CWE-732 at MITRE
Ask an AI about CWE-732
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-732: Incorrect Permission Assignment for Critical Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/732.html and https://cve.bz/cve/cwe/732?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.2CVE-2024-5915EPSS 0.2%
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.
- 5.4CVE-2024-25561EPSS 0.1%
Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 5.4CVE-2024-23908EPSS 0.1%
Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 8.5CVE-2024-6619EPSS 0.1%
In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.
- 7.8CVE-2024-43199EPSS 1.1%
Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.
- 6.0CVE-2024-41820EPSS 0.4%
Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can ab…
- 8.0CVE-2024-41720EPSS 0.2%
Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device.
- 7.8CVE-2024-41954EPSS 0.3%
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting t…
- 7.8CVE-2024-31202EPSS 0.2%
A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.
- 7.5CVE-2022-33167EPSS 0.4%
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this…
- 4.4CVE-2024-27883EPSS 0.3%
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to modify protected parts of the file system.
- 6.9CVE-2024-41685EPSS 0.5%
This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting t…
- 8.2CVE-2024-1724EPSS 0.3%
In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker…
- 9.9CVE-2024-5618EPSS 0.4%
Incorrect Permission Assignment for Critical Resource vulnerability in PruvaSoft Informatics Apinizer Management Console allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Apinizer Management Console: befo…
- 8.7CVE-2024-6435EPSS 0.5%
A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, a…
- 3.3CVE-2024-6780EPSS 0.2%
Improper permission control in the mobile application (com.android.server.telecom) may lead to user information security risks.
- 6.1CVE-2024-6739EPSS 0.4%
The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session cookie via XSS.
- 6.7CVE-2024-20456EPSS 0.2%
A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the Cisco Secure Boot functionality and load unverified software on an affected device. To exploit thi…
- 7.8CVE-2024-28827EPSS 0.2%
Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker to gain SYSTEM privileges.
- 5.3CVE-2024-39875EPSS 0.3%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about…
- 5.3CVE-2024-37087EPSS 0.7%
The vCenter Server contains a denial-of-service vulnerability. A malicious actor with network access to vCenter Server may create a denial-of-service condition.
- 9.8CVE-2024-5163EPSS 0.5%
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.
- 8.5CVE-2024-37369EPSS 0.3%
A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system.
- 6.8CVE-2024-36821EPSS 2.9%
Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.
- 8.8CVE-2024-3668EPSS 0.4%
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a regi…
- 7.8CVE-2024-30369EPSS 0.3%
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the abil…
- 7.5CVE-2024-29078EPSS 0.4%
Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker with access to the product to alter the product settings.
- 8.1CVE-2024-21902EPSS 0.4%
An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a…
- 7.8CVE-2024-21835EPSS 0.2%
Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.3CVE-2023-5936EPSS 0.1%
On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges.
- 6.8CVE-2024-27108EPSS 0.3%
Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products
- 9.4CVE-2024-33499EPSS 0.5%
A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All ver…
- 5.2CVE-2024-30208EPSS 0.2%
A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All ver…
- 7.4CVE-2024-1486EPSS 0.2%
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
- 7.8CVE-2023-35841EPSS 0.4%
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
- 7.8CVE-2023-47712EPSS 0.2%
IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X-Force ID: 271527.
- 7.8CVE-2023-51579EPSS 0.2%
Voltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker must f…
- 7.8CVE-2023-40516EPSS 0.3%
LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of LG Simple Editor. An attacker must first obtain the ab…
- 6.7CVE-2024-24912EPSS 0.2%
A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged …
- 9.8CVE-2024-33435EPSS 0.9%
Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.…
- 9.4CVE-2024-3375EPSS 0.5%
Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.
- 6.2CVE-2024-2905EPSS 0.3%
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than rec…
- 6.9CVE-2024-32478EPSS 0.2%
Git Credential Manager (GCM) is a secure Git credential helper. Prior to 2.5.0, the Debian package does not set root ownership on installed files. This allows user 1001 on a multi-user system can replace binary and gain other users' privil…
- 6.5CVE-2024-29964EPSS 0.5%
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files. An unprivileged attacker who gains access to the server can read sensitive information from these files.
- 7.3CVE-2024-24910EPSS 0.2%
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain t…
- 6.1CVE-2024-21063EPSS 0.2%
Vulnerability in the PeopleSoft Enterprise HCM Benefits Administration product of Oracle PeopleSoft (component: Benefits Administration). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileg…
- 4.4CVE-2024-22334EPSS 0.4%
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 could be vulnerable to incomplete revocation of permissions when deleting a custom s…
- 6.5CVE-2024-25646EPSS 0.4%
Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact…
- 6.5CVE-2023-52554EPSS 0.2%
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5CVE-2023-52388EPSS 0.4%
Permission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.