CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5441 vulnerabilities reference this CWE, most recent first.
GHSA-J6XF-JWRJ-V5QP
Vulnerability from github – Published: 2025-09-05 20:19 – Updated: 2025-09-10 20:50Summary
Insecure session handling opened room for a privilege escalation scenario in which prebuilt workspaces could be compromised by abusing a shared system identity.
Details
Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user.
When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.
For example, the coder-login module allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.
This causes a script to be run on workspace startup that runs the command coder login using the automatically generated user session token c.f. https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23
This module was originally written before the inception of the prebuilds feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular prebuilds system user.
When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the prebuilds user to disk. Because the coder-login module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the prebuildsuser upon claim:
Impact
Important: Deployments that have never utilized the prebuilds feature are not affected by this vulnerability.
This vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.
The prebuilds user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the prebuilds user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the prebuilds user.
This means that a malicious authenticated actor can potentially execute code on other workspaces owned by the prebuilds user and potentially access information of other users once they claim a previously poisoned workspace.
Remediation
Fixed in https://github.com/coder/coder/pull/19667
Note that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.
To identify potentially affected workspaces, run the following SQL query against the Coder database:
SELECT w.id, w.name, w.owner_id, u.email
FROM workspaces w
LEFT JOIN users u ON u.id = w.owner_id
WHERE w.owner_id <> 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid
AND NOT w.deleted
AND EXISTS (
SELECT 1
FROM workspace_builds AS wb
WHERE wb.workspace_id = w.id
AND wb.initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid
);
Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via
coder tokens list --all
Premium license customers can also take advantage of the audit logs feature to query actions performed by the prebuilds user.
Following filter can be used to verify if no API keys were created by the prebuilds user
would indicate a potentially malicious action aimed at achieving persistence
username:prebuilds resource_type:api_key
Following filter can be used to list all write operations performed by the prebuilds user (including failed attempts to update various settings)
username:prebuilds action:write
Patched versions
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.22.0"
},
{
"fixed": "2.24.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/coder/coder/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.25.0"
},
{
"fixed": "2.25.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-58437"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-277",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-05T20:19:58Z",
"nvd_published_at": "2025-09-06T03:15:40Z",
"severity": "HIGH"
},
"details": "## Summary\n\nInsecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.\n\n## Details\n\nCoder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user. \n\nWhen a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. \n\nFor example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.\n\nThis causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23)\n\nThis module was originally written before the inception of the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature in Coder, which essentially creates a \"pre-warmed\" pool of workspaces owned by a particular `prebuilds` system user.\n\nWhen this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the `prebuilds` user to disk. Because the `coder-login` module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the `prebuilds`user upon claim:\n\n## Impact\n\n\u003e Important: **Deployments that have never utilized the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature are not affected by this vulnerability.**\n\n\nThis vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.\n\nThe `prebuilds` user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the `prebuilds` user\u0027s credential can move laterally to any other prebuilt workspace, or create new workspaces as the `prebuilds` user.\n\nThis means that a malicious authenticated actor can potentially execute code on other workspaces owned by the `prebuilds` user and potentially access information of other users once they claim a previously poisoned workspace.\n\n\n## Remediation\n\nFixed in https://github.com/coder/coder/pull/19667\n\nNote that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.\n\nTo identify potentially affected workspaces, run the following SQL query against the Coder database:\n\n```sql\nSELECT w.id, w.name, w.owner_id, u.email\nFROM workspaces w\nLEFT JOIN users u ON u.id = w.owner_id\nWHERE w.owner_id \u003c\u003e \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n AND NOT w.deleted\n AND EXISTS (\n SELECT 1\n FROM workspace_builds AS wb\n WHERE wb.workspace_id = w.id\n AND wb.initiator_id = \u0027c42fdf75-3097-471c-8c33-fb52454d81c0\u0027::uuid\n );\n```\n\n\u003e Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via `coder tokens list --all`\n\n---\n\n[Premium license](https://coder.com/docs/admin/licensing) customers can also take advantage of the [audit logs](https://coder.com/docs/admin/security/audit-logs) feature to query actions performed by the `prebuilds` user.\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to verify if no [API keys](https://coder.com/docs/reference/api/users#create-token-api-key) were created by the `prebuilds` user\n\u003e would indicate a potentially malicious action aimed at achieving [persistence](https://attack.mitre.org/tactics/TA0003/)\n```\nusername:prebuilds resource_type:api_key\n```\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to list all *write* operations performed by the `prebuilds` user (including failed attempts to update various settings)\n```\nusername:prebuilds action:write\n```\n\n### Patched versions\n- [2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4)\n- [2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2)\n- [2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0)",
"id": "GHSA-j6xf-jwrj-v5qp",
"modified": "2025-09-10T20:50:29Z",
"published": "2025-09-05T20:19:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58437"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19667"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19668"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/pull/19669"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"
},
{
"type": "WEB",
"url": "https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"
},
{
"type": "PACKAGE",
"url": "https://github.com/coder/coder"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Coder vulnerable to privilege escalation could lead to a cross workspace compromise"
}
GHSA-J73P-GC9R-3PF8
Vulnerability from github – Published: 2024-07-22 12:30 – Updated: 2024-09-11 12:30On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config.
Mitigation:
all users should upgrade to 2.1.4
{
"affected": [],
"aliases": [
"CVE-2024-34457"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T10:15:03Z",
"severity": "MODERATE"
},
"details": "On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone\u0027s user flink information, including executeSQL and config.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\n",
"id": "GHSA-j73p-gc9r-3pf8",
"modified": "2024-09-11T12:30:51Z",
"published": "2024-07-22T12:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34457"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/07/22/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/22/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J75V-3JH6-3CFC
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048
{
"affected": [],
"aliases": [
"CVE-2021-0691"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-06T15:15:00Z",
"severity": "MODERATE"
},
"details": "In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048",
"id": "GHSA-j75v-3jh6-3cfc",
"modified": "2022-05-24T19:16:47Z",
"published": "2022-05-24T19:16:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0691"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-09-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J772-G9X7-9Q95
Vulnerability from github – Published: 2025-12-03 18:30 – Updated: 2025-12-03 18:30A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges.
{
"affected": [],
"aliases": [
"CVE-2025-55076"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-03T17:15:52Z",
"severity": "MODERATE"
},
"details": "A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges.",
"id": "GHSA-j772-g9x7-9q95",
"modified": "2025-12-03T18:30:26Z",
"published": "2025-12-03T18:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55076"
},
{
"type": "WEB",
"url": "https://almightysec.com/plugin-alliance-helpertool-xpc-service-local-privilege-escalation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J77Q-V8WQ-8WJV
Vulnerability from github – Published: 2024-06-12 21:31 – Updated: 2024-08-21 15:30An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request.
{
"affected": [],
"aliases": [
"CVE-2024-37665"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-12T21:15:50Z",
"severity": "HIGH"
},
"details": "An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request.",
"id": "GHSA-j77q-v8wq-8wjv",
"modified": "2024-08-21T15:30:49Z",
"published": "2024-06-12T21:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37665"
},
{
"type": "WEB",
"url": "https://github.com/648540858/wvp-GB28181-pro"
},
{
"type": "WEB",
"url": "https://github.com/guipi01/WVP-GB28181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J78X-7P3C-FHW7
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 18:31The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_role' parameter. This makes it possible for unauthenticated attackers to gain elevated privileges by registering an account with the administrator role.
{
"affected": [],
"aliases": [
"CVE-2025-12882"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T07:17:29Z",
"severity": "CRITICAL"
},
"details": "The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the \u0027listing_user_role\u0027 parameter. This makes it possible for unauthenticated attackers to gain elevated privileges by registering an account with the administrator role.",
"id": "GHSA-j78x-7p3c-fhw7",
"modified": "2026-02-19T18:31:49Z",
"published": "2026-02-19T18:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12882"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/clasifico-classified-ads-wordpress-theme/33539482"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70fb90f0-1ca4-41fe-8638-cdd05747adae?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7C5-G427-27CH
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2023-08-08 15:31In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194105348
{
"affected": [],
"aliases": [
"CVE-2021-39623"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "CRITICAL"
},
"details": "In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-194105348",
"id": "GHSA-j7c5-g427-27ch",
"modified": "2023-08-08T15:31:36Z",
"published": "2022-01-15T00:01:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39623"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7FG-3JPP-JW6J
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2022-05-24 17:06An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2020-0636"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-14T23:15:00Z",
"severity": "MODERATE"
},
"details": "An elevation of privilege vulnerability exists in the way that the Windows Subsystem for Linux handles files, aka \u0027Windows Subsystem for Linux Elevation of Privilege Vulnerability\u0027.",
"id": "GHSA-j7fg-3jpp-jw6j",
"modified": "2022-05-24T17:06:19Z",
"published": "2022-05-24T17:06:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0636"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0636"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J7H9-FX4J-Q5VR
Vulnerability from github – Published: 2024-01-03 09:30 – Updated: 2024-01-10 15:30An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
{
"affected": [],
"aliases": [
"CVE-2023-50921"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-03T09:15:09Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system module to gain root privileges. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.",
"id": "GHSA-j7h9-fx4j-q5vr",
"modified": "2024-01-10T15:30:18Z",
"published": "2024-01-03T09:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50921"
},
{
"type": "WEB",
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/Add_user_vulnerability.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7M5-9HHG-47P4
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-07-13 00:00In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10, Android-11, Android-8.0, Android-8.1, Android-9; Android ID: A-168319670.
{
"affected": [],
"aliases": [
"CVE-2021-0317"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-11T22:15:00Z",
"severity": "HIGH"
},
"details": "In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-10, Android-11, Android-8.0, Android-8.1, Android-9; Android ID: A-168319670.",
"id": "GHSA-j7m5-9hhg-47p4",
"modified": "2022-07-13T00:00:58Z",
"published": "2022-05-24T17:38:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0317"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2021-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-1
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.