CWE-272
AllowedLeast Privilege Violation
Abstraction: Base · Status: Incomplete
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
68 vulnerabilities reference this CWE, most recent first.
GHSA-9FC8-V7VW-438W
Vulnerability from github – Published: 2024-02-06 09:31 – Updated: 2024-02-06 09:31Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninstallation
{
"affected": [],
"aliases": [
"CVE-2023-32451"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T08:15:48Z",
"severity": "HIGH"
},
"details": "\nDell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during installation and uninstallation\n\n",
"id": "GHSA-9fc8-v7vw-438w",
"modified": "2024-02-06T09:31:38Z",
"published": "2024-02-06T09:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32451"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000215216/dsa-2023-182-dell"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CW49-J239-69W3
Vulnerability from github – Published: 2026-09-09 18:32 – Updated: 2026-09-09 18:32Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
{
"affected": [],
"aliases": [
"CVE-2026-79693"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T16:17:07Z",
"severity": "LOW"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.",
"id": "GHSA-cw49-j239-69w3",
"modified": "2026-09-09T18:32:03Z",
"published": "2026-09-09T18:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79693"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G5FC-F834-RCR2
Vulnerability from github – Published: 2026-04-03 03:31 – Updated: 2026-08-25 15:32In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2026-35535"
],
"database_specific": {
"cwe_ids": [
"CWE-271",
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-03T03:16:18Z",
"severity": "HIGH"
},
"details": "In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.",
"id": "GHSA-g5fc-f834-rcr2",
"modified": "2026-08-25T15:32:06Z",
"published": "2026-04-03T03:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535"
},
{
"type": "WEB",
"url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10758"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21695"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-35535"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/1130593"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00003.html"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35535.json"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2026/03/10/crack-armor.txt"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:11521"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:12310"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13731"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13888"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13889"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13891"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13892"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13895"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13896"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14228"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14437"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19067"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19220"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20040"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:20087"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21275"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21656"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H64C-RQQH-Q3FP
Vulnerability from github – Published: 2024-08-20 12:30 – Updated: 2024-12-03 18:31Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL) allows local users to escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2024-28829"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T10:15:05Z",
"severity": "MODERATE"
},
"details": "Least privilege violation and reliance on untrusted inputs in the mk_informix Checkmk agent plugin before Checkmk 2.3.0p12, 2.2.0p32, 2.1.0p47 and 2.0.0 (EOL) allows local users to escalate privileges.",
"id": "GHSA-h64c-rqqh-q3fp",
"modified": "2024-12-03T18:31:02Z",
"published": "2024-08-20T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28829"
},
{
"type": "WEB",
"url": "https://checkmk.com/werk/16249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J8PH-9C6M-2F5W
Vulnerability from github – Published: 2026-02-03 06:31 – Updated: 2026-02-06 21:30A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to “root” using the export option of seccertmgmt and seccryptocfg commands.
{
"affected": [],
"aliases": [
"CVE-2025-9711"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T06:15:53Z",
"severity": "HIGH"
},
"details": "A vulnerability in Brocade Fabric OS before 9.2.1c3 could allow elevating the privileges of the local authenticated user to \u201croot\u201d using the export option of seccertmgmt and seccryptocfg commands.",
"id": "GHSA-j8ph-9c6m-2f5w",
"modified": "2026-02-06T21:30:48Z",
"published": "2026-02-03T06:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9711"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36852"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JCXX-5QW5-HPHM
Vulnerability from github – Published: 2026-08-18 21:31 – Updated: 2026-08-18 21:31Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
{
"affected": [],
"aliases": [
"CVE-2026-59915"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T20:17:19Z",
"severity": "HIGH"
},
"details": "Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.",
"id": "GHSA-jcxx-5qw5-hphm",
"modified": "2026-08-18T21:31:50Z",
"published": "2026-08-18T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59915"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000501384/dsa-2026-334-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MXR3-8WHJ-J74R
Vulnerability from github – Published: 2025-04-22 01:07 – Updated: 2025-04-22 01:07Summary
Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with the Docker daemon to launch privileged containers or access the host filesystem. This allows the attacker to regain root access or restore the sudoers file, effectively bypassing the restriction.
For an attacker to bypass this control, they would first need the ability to run their malicious code (e.g., by a supply chain attack similar to tj-actions or exploiting a Pwn Request vulnerability)) on the runner. This vulnerability has been fixed in Harden-Runner version v2.12.0.
Impact
An attacker with the ability to run their malicious code on a runner configured with disable-sudo: true can escalate privileges to root using Docker, defeating the intended security control.
Affected Configuration
• Harden-Runner configurations that use disable-sudo: true on GitHub-hosted runners or on ephemeral self-hosted VM-based runners.
• This issue does not apply to Kubernetes-based Actions Runner Controller (ARC) Harden-Runner.
Mitigation / Fix
This vulnerability has been fixed in Harden-Runner version v2.12.0. Users should migrate to the stronger disable-sudo-and-containers policy. This setting:
• Disables sudo access,
• Removes access to dockerd and containerd sockets,
• Uninstalls Docker from the runner entirely, preventing container-based privilege escalation paths.
Additional Improvements
• The disable-sudo option will be deprecated in the future, as it does not sufficiently restrict privilege escalation on its own.
• Harden-Runner now includes detections to alert on attempts to evade the disable-sudo policy.
Credits
Reported by @loresuso and @darryk10. We would like to thank them for collaborating with us to mitigate the vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "GitHub Actions",
"name": "step-security/harden-runner"
},
"ranges": [
{
"events": [
{
"introduced": "0.12.0"
},
{
"fixed": "2.12.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-32955"
],
"database_specific": {
"cwe_ids": [
"CWE-250",
"CWE-268",
"CWE-272"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T01:07:03Z",
"nvd_published_at": "2025-04-21T21:15:20Z",
"severity": "MODERATE"
},
"details": "### Summary\nHarden-Runner includes a policy option `disable-sudo` to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with the Docker daemon to launch privileged containers or access the host filesystem. This allows the attacker to regain root access or restore the sudoers file, effectively bypassing the restriction. \n\nFor an attacker to bypass this control, they would first need the ability to run their malicious code (e.g., by a supply chain attack similar to tj-actions or exploiting a Pwn Request vulnerability)) on the runner. This vulnerability has been fixed in Harden-Runner version `v2.12.0`.\n\n### Impact\nAn attacker with the ability to run their malicious code on a runner configured with `disable-sudo: true` can escalate privileges to root using Docker, defeating the intended security control.\n\n### Affected Configuration\n\u2022\tHarden-Runner configurations that use `disable-sudo: true` on GitHub-hosted runners or on ephemeral self-hosted VM-based runners.\n\u2022\tThis issue does not apply to Kubernetes-based Actions Runner Controller (ARC) Harden-Runner.\n\n### Mitigation / Fix\nThis vulnerability has been fixed in Harden-Runner version `v2.12.0`. Users should migrate to the stronger `disable-sudo-and-containers` policy. This setting:\n\u2022\tDisables sudo access,\n\u2022\tRemoves access to dockerd and containerd sockets,\n\u2022\tUninstalls Docker from the runner entirely, preventing container-based privilege escalation paths.\n\n\n### Additional Improvements\n\u2022\tThe `disable-sudo` option will be deprecated in the future, as it does not sufficiently restrict privilege escalation on its own. \n\u2022\tHarden-Runner now includes detections to alert on attempts to evade the `disable-sudo` policy.\n\n\n### Credits\nReported by @loresuso and @darryk10. We would like to thank them for collaborating with us to mitigate the vulnerability.",
"id": "GHSA-mxr3-8whj-j74r",
"modified": "2025-04-22T01:07:03Z",
"published": "2025-04-22T01:07:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/step-security/harden-runner/security/advisories/GHSA-mxr3-8whj-j74r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32955"
},
{
"type": "WEB",
"url": "https://github.com/step-security/harden-runner/commit/0634a2670c59f64b4a01f0f96f84700a4088b9f0"
},
{
"type": "PACKAGE",
"url": "https://github.com/step-security/harden-runner"
},
{
"type": "WEB",
"url": "https://github.com/step-security/harden-runner/releases/tag/v2.12.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Harden-Runner allows evasion of \u0027disable-sudo\u0027 policy"
}
GHSA-PMPQ-66CP-597X
Vulnerability from github – Published: 2026-01-26 12:30 – Updated: 2026-01-27 21:31The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
{
"affected": [],
"aliases": [
"CVE-2025-59106"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-26T10:16:08Z",
"severity": "HIGH"
},
"details": "The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.",
"id": "GHSA-pmpq-66cp-597x",
"modified": "2026-01-27T21:31:46Z",
"published": "2026-01-26T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59106"
},
{
"type": "WEB",
"url": "https://r.sec-consult.com/dkaccess"
},
{
"type": "WEB",
"url": "https://r.sec-consult.com/dormakaba"
},
{
"type": "WEB",
"url": "https://www.dormakabagroup.com/en/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PVJH-6P44-VCV3
Vulnerability from github – Published: 2025-07-23 03:32 – Updated: 2025-07-23 03:32The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.
{
"affected": [],
"aliases": [
"CVE-2025-7722"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-23T03:15:25Z",
"severity": "HIGH"
},
"details": "The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user\u0027s identity prior to updating their user meta information in the update_user_meta() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their user type to that of an administrator.",
"id": "GHSA-pvjh-6p44-vcv3",
"modified": "2025-07-23T03:32:05Z",
"published": "2025-07-23T03:32:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7722"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/social-streams/trunk/src/php/JsonAPI.php#275"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f01b88-6f93-4ee8-8d59-9165ebcd4dd1?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PWJH-HFQC-XGC7
Vulnerability from github – Published: 2026-05-13 18:30 – Updated: 2026-05-13 18:30A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2026-39459"
],
"database_specific": {
"cwe_ids": [
"CWE-272"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-13T16:16:41Z",
"severity": "HIGH"
},
"details": "A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.\n\n\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-pwjh-hfqc-xgc7",
"modified": "2026-05-13T18:30:55Z",
"published": "2026-05-13T18:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39459"
},
{
"type": "WEB",
"url": "https://my.f5.com/manage/s/article/K000160863"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.