Insecure Inherited Permissions
CWE-277
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
We track 37 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Architecture and Design Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Insecure Inherited Permissions vulnerabilities
- 7.0 High severity
Legion Zone: Insecure Inherited Permissions
A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrar
- 7.2 High severity
ArubaOS (AOS): Insecure Inherited Permissions
Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Successful exploitation could allow an authenticated malicious actor to create or modify arbi
- 8.8 High severity
i-Educar: Incorrect Privilege Assignment
A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecu
- 8.1 High severity
Coder allows organizations to provision remote development environments via Terraform.
Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a sess
- 7.0 High severity
conda-build: Insecure Inherited Permissions
Conda-build contains commands and tools to build conda packages. Prior to version 25.3.1, the write_build_scripts function in conda-build creates the temporary build script conda_build.sh with overly permissive file permissions (0o766), allowing write access t
- 7.7 High severity
Intel(R) Simics(R) Package Manager software: Insecure Inherited Permissions
Insecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to potentially enable escalation of privilege via local access.
- 7.1 High severity
SAP BusinessObjects Business Intelligence…: Insecure Inherited Permissions
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity an
- 7.8 High severity
Intel(R) DSA software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) CIP software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) HID Event Filter software installers: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) HID Event Filter software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Flexlm License Daemons for Intel(R) FPGA…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Flexlm License Daemons for Intel(R) FPGA software before version v11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 8.3 High severity
Red Hat Ansible Automation Platform 2: Insecure Inherited Permissions
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object crea
- 9.8 Critical severity
external-secrets: Insecure Inherited Permissions
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- 8.4 High severity
datacard_xps_card_printer_driver: Insecure Inherited Permissions
Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated attackers to execute arbitrary code as SYSTEM via a crafted DLL payload.
- 7.5 High severity
lin-cms-java-core: Insecure Inherited Permissions
Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.
- 8.8 High severity
Apache Airflow: Improper Control of Generation of Code
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Secur
- 7.8 High severity
iOS and iPadOS: Incorrect Authorization
This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A malicious app may be able to gain root privileges.
- 7.8 High severity
Intel(R) XTU software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Power Gadget software for Windows: Insecure Inherited Permissions
Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.1 High severity
macOS: Insecure Inherited Permissions
A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Sonoma 14.5. An app may be able to bypass certain Privacy preferences.
- 8.4 High severity
horacius: Insecure Inherited Permissions
Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.
- 7.8 High severity
macOS: Insecure Inherited Permissions
This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used by a malicious app.
- 7.8 High severity
Intel(R) Ethernet tools and driver install…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel HID Event Filter drivers for Windows 10…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel Rapid Storage Technology software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel Server Configuration Utility software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Simics Simulator software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Pro Software Suite installation…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Watchdog Timer installation…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) oneMKL software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.1 High severity
SAP SQL Anywhere: Insecure Inherited Permissions
SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be lev
- 7.8 High severity
Intel(R) NUC Pro Software Suite: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC P14E Laptop Element software for…: Incorrect Default Permissions
Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) VTune(TM) Profiler software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Software Studio Service installer: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enable escalation of privilege via local access
- 8.8 High severity
Extplorer: Insecure Inherited Permissions
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent
- 7.8 High severity
Intel(R) Wireless Adapter Driver installation…: Incorrect Default Permissions
Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.