CWE-732— Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog

2,059 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-732page 35 of 42

CVE-2023-4565MEDIUMCVSS 5.3EG 5.3
2023-09-27
Broadcast permission control vulnerability in the framework module. Successful exploitation of this vulnerability may cause the hotspot feature to be unavailable.
CVE-2023-41295MEDIUMCVSS 5.3EG 5.3
2023-09-25
Vulnerability of improper permission management in the displayengine module. Successful exploitation of this vulnerability may cause the screen to turn dim.
CVE-2023-32005MEDIUMCVSS 5.3EG 5.3
2023-09-12
A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails t…
CVE-2022-33163MEDIUMCVSS 5.3EG 5.3
2023-06-15
IBM Security Directory Suite VA 8.0.1 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 228571.
CVE-2023-31445MEDIUMCVSS 5.3EG 5.3
2023-05-11
Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have the ability to enumerate all other users and discover e-mail addresses, phone nu…
CVE-2023-27084MEDIUMCVSS 5.3EG 5.3
2023-03-16
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
CVE-2022-48257MEDIUMCVSS 5.3EG 5.3
2023-01-13
In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
CVE-2022-4630MEDIUMCVSS 5.3EG 5.3
2022-12-21
Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master.
CVE-2020-15329MEDIUMCVSS 5.3EG 5.3
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions.
CVE-2020-15328MEDIUMCVSS 5.3EG 5.3
2022-09-29
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/var/blobstorage/ permissions.
CVE-2022-22330MEDIUMCVSS 5.3EG 5.3
2022-09-13
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X…
CVE-2021-38879MEDIUMCVSS 5.3EG 5.3
2022-06-24
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitiv…
CVE-2021-20355MEDIUMCVSS 5.3EG 5.3
2022-06-24
IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitiv…
CVE-2022-26157MEDIUMCVSS 5.3EG 5.3
2022-02-28
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencr…
CVE-2021-37058MEDIUMCVSS 5.3EG 5.3
2021-12-07
There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user's nickname is maliciously tampered with.
CVE-2020-4146MEDIUMCVSS 5.3EG 5.3
2021-11-12
IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. A remote attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 1…
CVE-2021-20526MEDIUMCVSS 5.3EG 5.3
2021-10-27
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. I…
CVE-2021-40066MEDIUMCVSS 5.3EG 5.3
2021-09-16
The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credentials can read data from it; regardless of access control group membership setting…
CVE-2021-20416MEDIUMCVSS 5.3EG 5.3
2021-07-07
IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive in…
CVE-2021-20429MEDIUMCVSS 5.3EG 5.3
2021-05-14
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. IBM X-Force ID: 196334.
CVE-2021-20996MEDIUMCVSS 5.3EG 5.3
2021-05-13
In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.
CVE-2021-31907MEDIUMCVSS 5.3EG 5.3
2021-05-11
In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.
CVE-2021-29247MEDIUMCVSS 5.3EG 5.3
2021-05-05
BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie.
CVE-2021-30479MEDIUMCVSS 5.3EG 5.3
2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to …
CVE-2020-10858MEDIUMCVSS 5.3EG 5.3
2021-02-05
Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler.
CVE-2021-25778MEDIUMCVSS 5.3EG 5.3
2021-02-03
In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
CVE-2021-25768MEDIUMCVSS 5.3EG 5.3
2021-02-03
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
CVE-2020-4625MEDIUMCVSS 5.3EG 5.3
2020-11-30
IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from…
CVE-2020-0805MEDIUMCVSS 5.3EG 5.3
2020-09-11
<p>A security feature bypass vulnerability exists when a Windows Projected Filesystem improperly handles file redirections. An attacker who successfully exploited this vulnerability could delete a targeted file they would not have permissi…
CVE-2017-18916MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
CVE-2016-11062MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
CVE-2017-18896MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
CVE-2019-20884MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.
CVE-2019-20875MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.
CVE-2018-21265MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).
CVE-2019-20869MEDIUMCVSS 5.3EG 5.3
2020-06-19
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.
CVE-2020-11911MEDIUMCVSS 5.3EG 5.3
2020-06-17
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
CVE-2020-12797MEDIUMCVSS 5.3EG 5.3
2020-06-11
HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
CVE-2020-12831MEDIUMCVSS 5.3EG 5.3
2020-05-13
An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information l…
CVE-2020-4289MEDIUMCVSS 5.3EG 5.3
2020-04-08
IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, and 1.0.5 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerab…
CVE-2011-4912MEDIUMCVSS 5.3EG 5.3
2020-02-04
Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.
CVE-2011-2515MEDIUMCVSS 5.3EG 5.3
2019-11-27
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
CVE-2019-18456MEDIUMCVSS 5.3EG 5.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 8.17 through 12.4 in the Search feature provided by Elasticsearch integration.. It has Insecure Permissions (issue 1 of 4).
CVE-2019-18452MEDIUMCVSS 5.3EG 5.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 11.3 through 12.4 when moving an issue to a public project from a private one. It has Insecure Permissions.
CVE-2019-18459MEDIUMCVSS 5.3EG 5.3
2019-11-26
An issue was discovered in GitLab Community and Enterprise Edition 11.3 to 12.3 in the protected environments feature. It has Insecure Permissions (issue 3 of 4).
CVE-2019-6465MEDIUMCVSS 5.3EG 5.3
2019-10-09
Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3…
CVE-2019-12245MEDIUMCVSS 5.3EG 5.3
2019-09-25
SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
CVE-2019-2389MEDIUMCVSS 5.3EG 5.3
2019-08-30
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue …
CVE-2018-20567MEDIUMCVSS 5.3EG 5.3
2018-12-28
An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read.
CVE-2018-16703MEDIUMCVSS 5.3EG 5.3
2018-09-07
A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple user enumerations, which can further help an attacker to perform login attempts in excess of the configured login attempt…

Map vulnerabilities like CWE-732 to your infrastructure

EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →