Placement of User into Incorrect Group
CWE-842
The product or the administrator places a user into an incorrect group.
We track 10 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
Latest Placement of User into Incorrect Group vulnerabilities
- 7.5 High severity
EOS: Placement of User into Incorrect Group
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if
- 7.3 High severity
authd: Placement of User into Incorrect Group
authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from their UID, either because the account was created with authd prior to version 0.5.
- 9.0 Critical severity
CodeChecker: Authentication Bypass by Primary Weakness
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1
- 8.4 High severity
Verve® Asset Manager: Placement of User into Incorrect Group
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the
- 8.8 High severity
elabftw: Incorrect Privilege Assignment
eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and content in their assigned team/teams. A user may be an administrator in one team and
- 8.8 High severity
PowerScale OneFS: Placement of User into Incorrect Group
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network attacker could potentially exploit this vulnerability, leading to escalation of privileges, and information disclosure.
- 7.8 High severity
Ceph: Placement of User into Incorrect Group
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information.
- 7.1 High severity
buildah: Incorrect Authorization
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to
- 7.1 High severity
podman: Incorrect Authorization
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to
- 7.2 High severity
elabftw: Placement of User into Incorrect Group
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assign itself system administrator privileges within the application, or create a new