CWE-276 - Incorrect Default Permissions

Home/CWEs/CWE info/

CWE-276 Medium

Abstraction:
Base

Structure:
Simple

Status:
Draft

Weakness Name: Incorrect Default Permissions

Description: During installation, installed file permissions are set to allow anyone to modify those files.

Common Consequences: Scope: Confidentiality, Integrity
Impact: Read Application Data, Modify Application Data

Related Weaknesses: CWE-732Incorrect Permission Assignment for Critical ResourceHigh

Release Date:
2006-07-19

Latest Modification Date:
2023-06-29

Top Security News

Recorded Future CEO applauds "undesirable" designation by Russia

CISA orders federal agencies to secure Microsoft 365 tenants

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

LowCookie with SameSite Attribute None

HighExternal Redirect

LowPrivate IP Disclosure

InformationalEmail address found in WebSocket message

LowMultiple HREFs Redirect Detected (Potential Sensitive Information Leak)

InformationalCORS Header

MediumApplication Error Disclosure via WebSockets

InformationalUsername Hash Found

MediumCSP: script-src unsafe-inline

HighCORS Misconfiguration

Latest CVE List

CVE-2021-44207 Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

Common CWEs

CWE-687 Function Call With Incorrectly Specified Argument Value

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-1273 Device Unlock Credential Sharing

MediumCWE-476 NULL Pointer Dereference

CWE-1127 Compilation with Insufficient Warnings or Errors

CWE-406 Insufficient Control of Network Message Volume (Network Amplification)

CWE-351 Insufficient Type Distinction

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

LowCWE-779 Logging of Excessive Data

CWE-521 Weak Password Requirements

Free security scan for your website

Don't show website scan report rating on the leaderboard

CWE-276 - Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.