CWE-282 Improper Ownership Management
classThe product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (36)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-0386US | high7.8OT kritisch | KEV | ||
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a u… | ||||
| CVE-2024-8949US | high8.8 | Exploit | ||
A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart… | ||||
| CVE-2024-3383US | critical9.1 | — | ||
A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user… | ||||
| CVE-2020-15663US | high8.8 | — | ||
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozil… | ||||
| CVE-2024-37999US | high7.8 | — | ||
A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high privileges and network acces… | ||||
| CVE-2022-29187US | high7.8 | — | ||
Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all… | ||||
| CVE-2020-14019US | high7.8OT erhöht | — | ||
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not pres… | ||||
| CVE-2017-12189US | high7.8 | — | ||
It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege… | ||||
| CVE-2019-12447US | high7.3 | — | ||
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used. | ||||
| CVE-2022-0026US | medium6.7 | — | ||
A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privil… | ||||
| CVE-2026-23514US | medium6.5 | — | ||
Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized co… | ||||
| CVE-2024-45104US | medium6.5 | — | ||
A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call. | ||||
| CVE-2023-7226US | medium6.5 | — | ||
A vulnerability was found in meetyoucrop big-whale 1.1 and classified as critical. Affected by this issue is some unknown functionality of the file /auth/user/all.api of the compon… | ||||
| CVE-2025-57732US | medium6.3OT erhöht | — | ||
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership | ||||
| CVE-2019-12449US | medium5.7 | — | ||
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METAD… | ||||
| CVE-2023-0989US | medium5.7 | — | ||
An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to ext… | ||||
| CVE-2024-43176US | medium5.4 | — | ||
IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. | ||||
| CVE-2020-10632US | medium5.3 | — | ||
Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fai… | ||||
| CVE-2026-86769US | medium4.3 | — | ||
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the cre… | ||||
| CVE-2026-50130US | — | — | ||
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged… | ||||
04
Angriffsmuster (2)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan