Improper Ownership Management
CWE-282
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
We track 9 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Latest Improper Ownership Management vulnerabilities
- 7.3 High severity
Docker Sandboxes: Improper Ownership Management
Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx or sandboxd is run as root with HOME or, on Linux, XDG_STATE_HOME pointing to an attacker-controlled location, a local unprivileged user can substitu
- 8.8 High severity
pi-hole: Improper Ownership Management
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replac
- 8.0 High severity
EnerVista UR Setup: Improper Ownership Management
CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
- 7.8 High severity
Anka Build: Improper Ownership Management
A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability
- 8.8 High severity
Online Eyewear Shop: Improper Ownership Management
A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/id leads to improper o
- 7.8 High severity
Medicalis Workflow Orchestrator: Improper Ownership Management
A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network access. This could allow an authenticated local attacker to escalate privileges.
- 9.1 Critical severity
PAN-OS: Improper Ownership Management
A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed
- 7.8 High severity
Linux Kernel Improper Ownership Management Exploited
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mappi
- 7.8 High severity
git: Uncontrolled Search Path Element
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported i