Incorrect Permission Assignment for Critical Resource
CWE-732
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
We track 420 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1. 5 have been exploited in real attacks.
How this weakness is prevented
- Implementation: When using a critical resource such as a configuration file, check to see if the resource has insecure permissions (such as being modifiable by any regular user), and generate an error or even exit the software if there is a possibility that the resource could have been modified by an unauthorized party.
- Architecture and Design: Divide the software into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully defining distinct user groups, privileges, and/or roles. Map these against data, functionality, and the related resources. Then set the permissions accordingly. This will allow you to maintain more fine-grained control over your resources.
- Implementation Installation: During program startup, explicitly set the default permissions or umask to the most restrictive setting possible. Also set the appropriate permissions during program installation. This will prevent you from inheriting insecure permissions from any user who installs or runs the program.
- System Configuration: For all configuration files, executables, and libraries, make sure that they are only readable and writable by the software's administrator.
- Documentation: Do not suggest insecure configuration changes in documentation, especially if those configurations can extend to resources and other programs that are outside the scope of the application.
Latest Incorrect Permission Assignment for Critical Resource vulnerabilities
- 7.8 High severity
ViewPower: Incorrect Permission Assignment for Critical Resource
Voltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower. An attacker must first obtain the abili
- 7.8 High severity
Simple Editor: Incorrect Permission Assignment for Critical Resource
LG Simple Editor Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of LG Simple Editor. An attacker must first obtain the ability to execute low-
- 9.8 Critical severity
ncast_yingshi: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function
- 9.4 Critical severity
Dialogue: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.
- 7.3 High severity
ZoneAlarmExtremeSecurityNextGen,IdentityAgentfo…: Incorrect Permission Assignment for Critical Resource
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.
- 7.3 High severity
issues: Incorrect Permission Assignment for Critical Resource
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard u
- 7.8 High severity
puppet-golang: Incorrect Permission Assignment for Critical Resource
dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, in
- 8.8 High severity
FactoryTalk® Service Platform: Incorrect Permission Assignment for Critical Resource
A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A
- 7.8 High severity
Intel(R) Ethernet tools and driver install…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) Ethernet tools and driver install software may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.5 High severity
Apache Solr: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced
- 8.1 High severity
Qsync Central: Incorrect Permission Assignment for Critical Resource
An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow authenticated users to read or modify the resource via a network. We have already fixed the vulnerabil
- 7.8 High severity
Rapid SCADA: Incorrect Permission Assignment for Critical Resource
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.
- 7.8 High severity
Intel HID Event Filter drivers for Windows 10…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before version 2.2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.
- 7.5 High severity
HarmonyOS: Incorrect Permission Assignment for Critical Resource
Vulnerability of permissions being not strictly verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentiality.
- 8.8 High severity
H8951-4G-ESP: Incorrect Permission Assignment for Critical Resource
An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.
- 7.8 High severity
Spectrum Power 7: Incorrect Permission Assignment for Critical Resource
A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inje
- 7.8 High severity
ZXCLOUD iRAI: Improper Privilege Management
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
- 8.8 High severity
AXC F 1152: Incorrect Permission Assignment for Critical Resource
A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with low privileges to gain full access on the affected devices.
- 9.8 Critical severity
Automation Worx Software Suite: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in multiple products of the PHOENIX CONTACT classic line allow an remote unauthenticated attacker to gain full access of the affected device.
- 9.8 Critical severity
MULTIPROG: Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attacker to upload arbitrary malicious code and gain full access on the affected device.
- 7.8 High severity
ZXCLOUD iRAI: Incorrect Permission Assignment for Critical Resource
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.
- 9.8 Critical severity
Remote Desktop Manager: Incorrect Permission Assignment for Critical Resource
Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without restriction.
- 7.3 High severity
SAP GUI for Windows and SAP GUI for Java: Incorrect Permission Assignment for Critical Resource
SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows
- 7.8 High severity
Mullvad VPN: Incorrect Permission Assignment for Critical Resource
An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM.
- 7.8 High severity
pyinstaller: Incorrect Permission Assignment for Critical Resource
PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise
- 9.1 Critical severity
Forgejo: Incorrect Permission Assignment for Critical Resource
In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked. This allows remote attackers to read private issues, read private pull requests, delete issues, and perform other unau
- 7.8 High severity
ProWatch: Incorrect Permission Assignment for Critical Resource
Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution.
- 7.8 High severity
Intel Rapid Storage Technology software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel Server Configuration Utility software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) Simics Simulator software: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Pro Software Suite installation…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Intel(R) NUC Watchdog Timer installation…: Incorrect Permission Assignment for Critical Resource
Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- 7.8 High severity
Harmony Endpoint.: Incorrect Permission Assignment for Critical Resource
Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- 8.8 High severity
Inventory Management System: Incorrect Permission Assignment for Critical Resource
Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via IDOR in the password change function.
- 7.8 High severity
Qiata: Incorrect Permission Assignment for Critical Resource
SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which
- 7.5 High severity
Bently Nevada 3500 System: Exposure of Sensitive Information to an Unauthorized Actor
Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.
- 7.8 High severity
SICAM PAS/PQS: Incorrect Permission Assignment for Critical Resource
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and
- 7.8 High severity
SINEC NMS: Incorrect Permission Assignment for Critical Resource
A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing executable files and libraries. This could allow an authenticated local attacker to inject arbitrary