CWE-842 Placement of User into Incorrect Group
baseThe product or the administrator places a user into an incorrect group.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (12)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31007US | high7.2 | Exploit | ||
eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator role in a team to assig… | ||||
| CVE-2024-10082US | critical9.0OT elevated | — | ||
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication method confusion allows logging in as the bui… | ||||
| CVE-2024-25632US | high8.8 | — | ||
eLabFTW is an open source electronic lab notebook for research labs. In the context of eLabFTW, an administrator is a user account with certain privileges to manage users and conte… | ||||
| CVE-2022-45097US | high8.8OT elevated | — | ||
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. A low privileged network attacker could potentially exploit this vulnerability, leading… | ||||
| CVE-2022-3650US | high7.8 | — | ||
A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged informatio… | ||||
| CVE-2022-2990US | high7.1OT elevated | — | ||
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker ha… | ||||
| CVE-2022-2989US | high7.1OT elevated | — | ||
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has… | ||||
| CVE-2023-25575US | medium6.5OT elevated | — | ||
API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiPrope… | ||||
| CVE-2026-102585US | — | — | ||
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that… | ||||
| CVE-2026-73439US | — | — | ||
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on… | ||||
| CVE-2026-6970US | — | — | ||
authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID (GID) differs from th… | ||||
| CVE-2024-9412US | — | — | ||
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan