CWE-271: Privilege Dropping / Lowering Errors
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
A kind of CWE-269 Improper Privilege Management.
From the CWE List. © The MITRE Corporation.
Newest
-
github.com/kahiteam/kahiGo Kahi has privilege-drop and socket/log permission issues No score - linuxfoundation cloudnativepg, cloudnative-pg, red hat openshift data foundation 4 +2 more CloudNativePG: Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE 9.4 Critical
- sudo project sudo, red hat ai inference server 3.3, enterprise linux 10 +25 more +27 more In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during... 7.4 High
- pop-os cosmic-greeter Incomplete privilege drop for com.system76.CosmicGreeter.GetUserData 5.8 Medium
- nixos nix Nix's privilege dropping to build user broke for macOS 7.9 High
-
screenAlpaquita Local root exploit via `logfile_reopen()` in screen 5.0.0 with setuid-root bit set 7.3 High - stalwartlabs mail-server Unprivileged Stalwart Mail Server user can read files as root 6.8 Medium
- postgresql PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL 8.0 High
- apptainer Apptainer's ineffective privileges drop when requesting container network 6.1 Medium
- suse rancher Rancher's Azure AD permission changes are not reflected on active sessions 8.0 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 more Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a... 7.8 High
- linux kernel, redhat enterprise linux +1 more A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network... 4.9 Medium
- kubernetes, netapp trident +1 more Kubernetes did not effectively clear service account credentials 3.1 Low