CWE-732— Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.— MITRE CWE catalog

2,076 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-732page 33 of 42

CVE-2020-10553MEDIUMCVSS 5.5EG 5.5
2021-02-05
An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the application. If that entry is removed, the lockscreen is no longer displayed and the…
CVE-2020-27098MEDIUMCVSS 5.5EG 5.5
2021-01-26
In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access contacts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User intera…
CVE-2020-27097MEDIUMCVSS 5.5EG 5.5
2021-01-26
In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…
CVE-2021-1126MEDIUMCVSS 5.5EG 5.5
2021-01-13
A vulnerability in the storage of proxy server credentials of Cisco Firepower Management Center (FMC) could allow an authenticated, local attacker to view credentials for a configured proxy server. The vulnerability is due to clear-text st…
CVE-2021-0304MEDIUMCVSS 5.5EG 5.5
2021-01-11
In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user's contacts with User execution privileges needed. User interac…
CVE-2020-5017MEDIUMCVSS 5.5EG 5.5
2021-01-08
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permissions. IBM X-Force ID: 193653.
CVE-2020-27041MEDIUMCVSS 5.5EG 5.5
2020-12-15
In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent. This could lead to local information disclosure of notification data with no additional execution privileges needed. User interaction is not nee…
CVE-2020-27034MEDIUMCVSS 5.5EG 5.5
2020-12-15
In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is …
CVE-2020-10762MEDIUMCVSS 5.5EG 5.5
2020-11-24
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows …
CVE-2020-0454MEDIUMCVSS 5.5EG 5.5
2020-11-10
In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User…
CVE-2020-17490MEDIUMCVSS 5.5EG 5.5
2020-11-06
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
CVE-2020-0410MEDIUMCVSS 5.5EG 5.5
2020-10-14
In setNotification of SapServer.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
CVE-2020-0400MEDIUMCVSS 5.5EG 5.5
2020-10-14
In showDataRoamingNotification of NotificationMgr.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not ne…
CVE-2020-0398MEDIUMCVSS 5.5EG 5.5
2020-10-14
In updateMwi of NotificationMgr.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitatio…
CVE-2020-15250MEDIUMCVSS 5.5EG 5.5
2020-10-12
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because o…
CVE-2020-10781MEDIUMCVSS 5.5EG 5.5
2020-09-16
A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and the ability to read the /sys/class/zram-control/hot_add file can create ZRAM device nodes in the /dev/ directory. This rea…
CVE-2020-4631MEDIUMCVSS 5.5EG 5.5
2020-08-04
IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with full control permissions, which could allow a local user to cause interruption of the service opera…
CVE-2020-9851MEDIUMCVSS 5.5EG 5.5
2020-06-09
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.5. A malicious application may be able to modify protected parts of the file system.
CVE-2020-1123MEDIUMCVSS 5.5EG 5.5
2020-05-21
A denial of service vulnerability exists when Connected User Experiences and Telemetry Service improperly handles file operations. An attacker who successfully exploited this vulnerability could cause a system to stop responding. To exploi…
CVE-2020-1084MEDIUMCVSS 5.5EG 5.5
2020-05-21
A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values. An attacker who successfully exploited this vulnerability could deny dependent security feature funct…
CVE-2020-12459MEDIUMCVSS 5.5EG 5.5
2020-04-29
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
CVE-2020-12458MEDIUMCVSS 5.5EG 5.5
2020-04-29
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleart…
CVE-2020-8472MEDIUMCVSS 5.5EG 5.5
2020-04-29
Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and …
CVE-2019-19894MEDIUMCVSS 5.5EG 5.5
2020-01-23
In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\I…
CVE-2019-14629MEDIUMCVSS 5.5EG 5.5
2020-01-17
Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2019-19727MEDIUMCVSS 5.5EG 5.5
2020-01-13
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
CVE-2019-19341MEDIUMCVSS 5.5EG 5.5
2019-12-19
A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and know…
CVE-2019-9464MEDIUMCVSS 5.5EG 5.5
2019-12-06
In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's pe…
CVE-2013-0326MEDIUMCVSS 5.5EG 5.5
2019-12-05
OpenStack nova base images permissions are world readable
CVE-2019-5212MEDIUMCVSS 5.5EG 5.5
2019-11-29
There is an improper access control vulnerability in Huawei Share. The software does not properly restrict access to certain file from certain application. An attacker tricks the user into installing a malicious application then establishi…
CVE-2019-3866MEDIUMCVSS 5.5EG 5.5
2019-11-08
An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user inform…
CVE-2019-15119MEDIUMCVSS 5.5EG 5.5
2019-08-16
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
CVE-2018-20908MEDIUMCVSS 5.5EG 5.5
2019-08-01
cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435).
CVE-2019-5222MEDIUMCVSS 5.5EG 5.5
2019-07-17
There is an information disclosure vulnerability on Secure Input of certain Huawei smartphones in Versions earlier than Tony-AL00B 9.1.0.216(C00E214R2P1). The Secure Input does not properly limit certain system privilege. An attacker trick…
CVE-2019-13142MEDIUMCVSS 5.5EG 5.5
2019-07-09
The RzSurroundVADStreamingService (RzSurroundVADStreamingService.exe) in Razer Surround 1.1.63.0 runs as the SYSTEM user using an executable located in %PROGRAMDATA%\Razer\Synapse\Devices\Razer Surround\Driver\. The DACL on this folder all…
CVE-2019-0976MEDIUMCVSS 5.5EG 5.5
2019-05-16
A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnera…
CVE-2018-4324MEDIUMCVSS 5.5EG 5.5
2019-04-03
A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls. This issue affected versions prior to macOS Mojave 10.14.
CVE-2018-4178MEDIUMCVSS 5.5EG 5.5
2019-04-03
A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affected versions prior to macOS High Sierra 10.13.4.
CVE-2018-4051MEDIUMCVSS 5.5EG 5.5
2019-04-02
An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally create directories and subdirectories on the root file system, as well a…
CVE-2019-2001MEDIUMCVSS 5.5EG 5.5
2019-02-28
The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel…
CVE-2018-9867MEDIUMCVSS 5.5EG 5.5
2019-02-19
In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerabili…
CVE-2019-0111MEDIUMCVSS 5.5EG 5.5
2019-02-18
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2019-0108MEDIUMCVSS 5.5EG 5.5
2019-02-18
Improper file permissions for Intel(R) Data Center Manager SDK before version 5.0.2 may allow an authenticated user to potentially enable disclosure of information via local access.
CVE-2018-3705MEDIUMCVSS 5.5EG 5.5
2018-12-14
Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to potentially enable a denial of service via local access.
CVE-2018-11002MEDIUMCVSS 5.5EG 5.5
2018-11-29
Pulse Secure Desktop Client 5.3 up to and including R6.0 build 1769 on Windows has Insecure Permissions.
CVE-2018-19072MEDIUMCVSS 5.5EG 5.5
2018-11-07
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, all…
CVE-2018-11951MEDIUMCVSS 5.5EG 5.5
2018-10-26
Improper access control in core module lead XBL_LOADER performs the ZI region clear for QTEE instead of XBL_SEC in Snapdragon Mobile in version SD 845, SD 850.
CVE-2018-15809MEDIUMCVSS 5.5EG 5.5
2018-08-23
AccuPOS 2017.8 is installed with the insecure "Authenticated Users: Modify" permission for files within the installation path. This may allow local attackers to compromise the integrity of critical resource and executable files.
CVE-2017-12167MEDIUMCVSS 5.5EG 5.5
2018-07-26
It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users l…
CVE-2018-0392MEDIUMCVSS 5.5EG 5.5
2018-07-18
A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions (i.e., World-Readable). An attacker co…

Map vulnerabilities like CWE-732 to your infrastructure

EchelonGraph correlates every CVE — across CWE-732 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →