Incorrect Default Permissions
CWE-276
During installation, installed file permissions are set to allow anyone to modify those files.
We track 518 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 3 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Operation: The architecture needs to access and modification attributes for files to only those users who actually require those actions.
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Incorrect Default Permissions vulnerabilities
- 7.8 High severity
Telerik Test Studio: Improper Privilege Management
In Telerik Test Studio versions prior to v2023.3.1330, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Test Studio install is present, a lower privileged user has the
- 7.1 High severity
Hitachi Storage Plug-in for VMware vCenter: Incorrect Default Permissions
Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.0.0 through 04.9.2.
- 7.5 High severity
Albo Pretorio On line: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.
- 7.1 High severity
IUCLID: Incorrect Default Permissions
A vulnerability, which was classified as critical, was found in European Chemicals Agency IUCLID 7.10.3 on Windows. Affected is an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulation leads to incorrect default permissi
- 7.8 High severity
Intel Integrated Sensor Hub (ISH) driver for…: Incorrect Default Permissions
Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software installers before version 5.4.1.4479 may allow an authenticated user to potentially enable escalation of privilege via loca
- 8.8 High severity
datahub: Incorrect Default Permissions
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These h
- 7.8 High severity
iDRAC Service Module (iSM): Incorrect Default Permissions
Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escalate privileges and execute arbitrary code on the affected system. Dell recommends customers upgrade at
- 7.1 High severity
Hitachi Tuning Manager: Incorrect Default Permissions
Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local users to read and write specific files.This issue affects Hitachi Tuning Manager: before 8.8.5-04.
- 7.8 High severity
Sysmac Studio: Incorrect Default Permissions
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
- 7.8 High severity
Cloudexplorer Lite: Incorrect Default Permissions
Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.
- 7.5 High severity
Opc: Incorrect Default Permissions
Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissions in OSF_discovery service. The service executable could be changed or the service could be deleted.
- 9.8 Critical severity
Android: Incorrect Default Permissions
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not ne
- 9.8 Critical severity
Gl-ax1800 Firmware: Incorrect Default Permissions
Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function.
- 7.2 High severity
A vulnerability was found in CSZCMS 1.3.0 and classified as critical.
A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the component File Manager Page. The manipulation leads to permission issues. The attack may be launched
- 8.8 High severity
Mprivacy-tools: Incorrect Default Permissions
In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to a VNC session) to access the X11 desktops of other users by specifying their DISPLAY ID. This allows
- 7.1 High severity
OpenHarmony: Incorrect Default Permissions
in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions.
- 9.8 Critical severity
concrete_cms: Incorrect Default Permissions
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessi
- 7.8 High severity
Secure Access: Incorrect Default Permissions
When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a specific file.
- 7.8 High severity
Secure Access Client: Incorrect Default Permissions
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, den
- 7.8 High severity
Intel Arc RGB Controller software: Incorrect Default Permissions
Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Arc(TM) Control software: Incorrect Default Permissions
Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Processors: Sequence of Processor Instructions Leads to Unexpected Behavior
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access.
- 7.8 High severity
1Lenovo Preload Directory: Incorrect Default Permissions
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.
- 7.5 High severity
Advanced Export Products Orders Cron Csv Excel: Incorrect Default Permissions
Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table.
- 7.8 High severity
Nessus Network Monitor: Improper Control of Generation of Code
NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM is installed to a non-standard location
- 7.8 High severity
Elliptic Labs Virtual Lock Sensor: Incorrect Default Permissions
A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges.
- 10.0 Critical severity
Cloud Lab: Incorrect Default Permissions
TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape.
- 7.8 High severity
Access Rights Manager: Incorrect Default Permissions
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows authenticated users to abuse local resources to Privilege Escalation.
- 7.8 High severity
Access Rights Manager: Incorrect Default Permissions
The SolarWinds Access Rights Manager was susceptible to Privilege Escalation Vulnerability. This vulnerability allows users to abuse incorrect folder permission resulting in Privilege Escalation.
- 9.8 Critical severity
Tsplus Remote Work: Incorrect Default Permissions
TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-202
- 7.8 High severity
Junos OS: Incorrect Default Permissions
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system
- 7.8 High severity
BIOS: Incorrect Default Permissions
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- 7.8 High severity
JP1/Performance Management - Manager: Incorrect Default Permissions
Incorrect Default Permissions vulnerability in Hitachi JP1/Performance Management on Windows allows File Manipulation.This issue affects JP1/Performance Management - Manager: from 09-00 before 12-50-07; JP1/Performance Management - Base: from 09-00 through 10-
- 7.8 High severity
Acronis Cyber Protect 15: Incorrect Default Permissions
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 35979.
- 9.8 Critical severity
RHEL-8 based Middleware Containers: Incorrect Default Permissions
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensit
- 7.5 High severity
mobile_security_framework: Incorrect Default Permissions
Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requi
- 8.8 High severity
Jenkins: Incorrect Default Permissions
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions for newly created files when installing a plugin from a URL, potentially allowing attackers with access to the system tem
- 7.5 High severity
Acronis Cyber Protect Home Office: Incorrect Default Permissions
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
- 7.8 High severity
GX Works3: Incorrect Default Permissions
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denia
- 7.8 High severity
visiwin_7: Incorrect Default Permissions
An issue was discovered in Inosoft VisiWin 7 through 2022-2.1 (Runtime RT7.3 RC3 20221209.5). The "%PROGRAMFILES(X86)%\INOSOFT GmbH" folder has weak permissions for Everyone, allowing an attacker to insert a Trojan horse file that runs as SYSTEM. 2024-1 is a f