CWE-732— Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog
2,059 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-732page 32 of 42
- CVE-2023-35799MEDIUMCVSS 5.5EG 5.52023-06-27
Stormshield Endpoint Security Evolution 2.0.0 through 2.3.2 has Insecure Permissions. An interactive user can use the SES Evolution agent to create arbitrary files with local system privileges.
- CVE-2023-21142MEDIUMCVSS 5.5EG 5.52023-06-15
In multiple files, there is a possible way to access traces in the dev mode due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exp…
- CVE-2023-28123MEDIUMCVSS 5.5EG 5.52023-04-19
A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UID VPN is starting.This vulnerability is fixed in Version 0.62.3 and later.
- CVE-2022-43309MEDIUMCVSS 5.5EG 5.52023-04-07
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.
- CVE-2022-3146MEDIUMCVSS 5.5EG 5.52023-03-23
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and …
- CVE-2022-3101MEDIUMCVSS 5.5EG 5.52023-03-23
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and …
- CVE-2023-20923MEDIUMCVSS 5.5EG 5.52023-01-26
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. …
- CVE-2022-47927MEDIUMCVSS 5.5EG 5.52023-01-12
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 06…
- CVE-2022-4365MEDIUMCVSS 5.5EG 5.52023-01-12
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry …
- CVE-2022-44746MEDIUMCVSS 5.5EG 5.52022-11-07
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- CVE-2022-42788MEDIUMCVSS 5.5EG 5.52022-11-01
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.
- CVE-2022-32929MEDIUMCVSS 5.5EG 5.52022-11-01
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 15.7 and iPadOS 15.7, iOS 16.1 and iPadOS 16. An app may be able to access iOS backups.
- CVE-2022-26238MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Service Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to acces…
- CVE-2022-26236MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Remisol Advance Launcher in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers…
- CVE-2022-26239MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand License Manager in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows unprivileged users to overwrite and manipulate executables and libraries. This allows attackers to access …
- CVE-2022-26237MEDIUMCVSS 5.5EG 5.52022-10-06
The default privileges for the running service Normand Viewer Service in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to overwrite and manipulate executables and libraries. This allows attackers to access…
- CVE-2022-20399MEDIUMCVSS 5.5EG 5.52022-09-13
In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. …
- CVE-2022-20290MEDIUMCVSS 5.5EG 5.52022-08-12
In Midi, there is a possible way to learn about private midi devices due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat…
- CVE-2022-20284MEDIUMCVSS 5.5EG 5.52022-08-12
In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of phone accounts with User execution privileges needed. User interaction is not needed for exploit…
- CVE-2014-0068MEDIUMCVSS 5.5EG 5.52022-06-30
It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permission.
- CVE-2022-21749MEDIUMCVSS 5.5EG 5.52022-06-06
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Pa…
- CVE-2022-21748MEDIUMCVSS 5.5EG 5.52022-06-06
In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS0…
- CVE-2021-0931MEDIUMCVSS 5.5EG 5.52021-12-15
In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. This could lead to local information disclosure with User execution privileges needed. User interaction is …
- CVE-2021-31377MEDIUMCVSS 5.5EG 5.52021-10-19
An Incorrect Permission Assignment for Critical Resource vulnerability of a certain file in the filesystem of Junos OS allows a local authenticated attacker to cause routing process daemon (RPD) to crash and restart, causing a Denial of Se…
- CVE-2021-30964MEDIUMCVSS 5.5EG 5.52021-08-24
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2. A malicious application may be able to bypass Privacy preferences.
- CVE-2021-30920MEDIUMCVSS 5.5EG 5.52021-08-24
A permissions issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.0.1. A local attacker may be able to read sensitive information.
- CVE-2021-30892MEDIUMCVSS 5.5EG 5.52021-08-24
An inherited permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.0.1, Security Update 2021-007 Catalina, macOS Big Sur 11.6.1. A malicious application may be able to modify protected parts…
- CVE-2021-38590MEDIUMCVSS 5.5EG 5.52021-08-11
In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).
- CVE-2021-0552MEDIUMCVSS 5.5EG 5.52021-06-22
In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed …
- CVE-2021-0572MEDIUMCVSS 5.5EG 5.52021-06-22
In doNotification of AccountManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed fo…
- CVE-2020-14335MEDIUMCVSS 5.5EG 5.52021-06-02
A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This flaw allows an attacker to gain control of DHCP records from the network. The highest threat from thi…
- CVE-2021-23021MEDIUMCVSS 5.5EG 5.52021-06-01
The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bits set to 644.
- CVE-2021-28646MEDIUMCVSS 5.5EG 5.52021-04-13
An insecure file permissions vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to take control of a specific log file on affected installations.
- CVE-2019-18243MEDIUMCVSS 5.5EG 5.52021-02-18
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
- CVE-2019-18255MEDIUMCVSS 5.5EG 5.52021-02-18
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.
- CVE-2020-26196MEDIUMCVSS 5.5EG 5.52021-02-09
Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role may potentially exploit this vulnerability resulting in the ability to write data outside of the inten…
- CVE-2020-10553MEDIUMCVSS 5.5EG 5.52021-02-05
An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the application. If that entry is removed, the lockscreen is no longer displayed and the…
- CVE-2020-27098MEDIUMCVSS 5.5EG 5.52021-01-26
In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access contacts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User intera…
- CVE-2020-27097MEDIUMCVSS 5.5EG 5.52021-01-26
In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…
- CVE-2021-1126MEDIUMCVSS 5.5EG 5.52021-01-13
A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. The vulnerability is due to clear-text st…
- CVE-2021-0304MEDIUMCVSS 5.5EG 5.52021-01-11
In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user's contacts with User execution privileges needed. User interac…
- CVE-2020-5017MEDIUMCVSS 5.5EG 5.52021-01-08
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653.
- CVE-2020-27041MEDIUMCVSS 5.5EG 5.52020-12-15
In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent. This could lead to local information disclosure of notification data with no additional execution privileges needed. User interaction is not nee…
- CVE-2020-27034MEDIUMCVSS 5.5EG 5.52020-12-15
In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is …
- CVE-2020-10762MEDIUMCVSS 5.5EG 5.52020-11-24
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows …
- CVE-2020-0454MEDIUMCVSS 5.5EG 5.52020-11-10
In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User…
- CVE-2020-17490MEDIUMCVSS 5.5EG 5.52020-11-06
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
- CVE-2020-0410MEDIUMCVSS 5.5EG 5.52020-10-14
In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
- CVE-2020-0400MEDIUMCVSS 5.5EG 5.52020-10-14
In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not ne…
- CVE-2020-0398MEDIUMCVSS 5.5EG 5.52020-10-14
In updateMwi of NotificationMgr.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
Map vulnerabilities like CWE-732 to your infrastructure
EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →