CWE-281 Improper Preservation of Permissions
baseThe product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (401)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-0847US | high7.8OT critical | KEV | ||
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker… | ||||
| CVE-2017-8543US | critical9.8OT critical | KEV | ||
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1 and Windows RT 8.1,… | ||||
| CVE-2021-33990US | critical9.8 | Exploit | ||
Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists. NOTE: The vendor disputes this issue because the exploit reference li… | ||||
| CVE-2019-0233US | high7.5 | — | ||
An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload. | ||||
| CVE-2023-34034US | critical9.8 | Exploit | ||
Using "**" as a pattern in Spring Security configuration
for WebFlux creates a mismatch in pattern matching between Spring
Security and Spring WebFlux, and the potential for a se… | ||||
| CVE-2017-8589US | critical9.8 | — | ||
Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016… | ||||
| CVE-2025-55130US | critical9.1 | Exploit | ||
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories… | ||||
| CVE-2022-38577US | high8.8 | Exploit | ||
ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. | ||||
| CVE-2022-1227US | high8.8 | Exploit | ||
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim… | ||||
| CVE-2021-45008US | high8.8 | Exploit | ||
Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-s… | ||||
| CVE-2012-3810US | high7.5 | Exploit | ||
Samsung Kies before 2.5.0.12094_27_11 has registry modification. | ||||
| CVE-2017-8465US | high7.8 | Exploit | ||
Microsoft Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to run processes in an elevated c… | ||||
| CVE-2024-44193US | high7.8 | Exploit | ||
A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges. | ||||
| CVE-2022-31262US | high7.8 | Exploit | ||
An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissions, an attacker can hijack the %ProgramData%\GOG.com folder… | ||||
| CVE-2021-39704US | high7.8 | Exploit | ||
In deleteNotificationChannelGroup of NotificationManagerService.java, there is a possible way to run foreground service without user notification due to a permissions bypass. This… | ||||
| CVE-2020-9442US | high7.8 | Exploit | ||
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a ma… | ||||
| CVE-2023-32231US | critical9.9 | — | ||
An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818. During installation, binaries gets executed out of a subfolder in C:\Windows\Temp. A standard u… | ||||
| CVE-2020-18890US | critical9.8 | — | ||
Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php. | ||||
| CVE-2018-4115US | critical9.8 | — | ||
An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The… | ||||
| CVE-2024-54465US | critical9.8 | — | ||
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges. | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan