CWE-250 325 件の CVE MITRE の定義 ↗

CWE-250: Execution with Unnecessary Privileges

概要

CWE-250(Execution with Unnecessary Privileges)は各種脆弱性データベースや評価で用いられる弱点タイプを説明します。定義・背景・対応する CVE は以下の各セクションを参照してください。

セキュリティへの影響
セキュリティ影響:製品や文脈に依存します。CVE 記録、深刻度、MITRE の説明を参照して優先度を判断してください。

説明

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

適用プラットフォーム

種別 名称 クラス 普遍性 OS / CPE
language Not Language-Specific Undetermined
technology AI/ML Often
technology Mobile Undetermined

このデータベースの関連 CVE

これらの CVE は本データベースでこの弱点に対応付けられており、追跡と検索のために保持されています。

CVE 公開 概要
CVE-2026-47190 2026-06-12 IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions (create, delete, get, list…
CVE-2026-12027 2026-06-11 Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a craft…
CVE-2026-11626 2026-06-10 CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an …
CVE-2026-50566 2026-06-10 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fissio…
CVE-2026-50565 2026-06-10 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission builder pods were created…
CVE-2026-46618 2026-06-10 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, before the round-1 security sweep…
CVE-2026-46617 2026-06-10 Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created…
CVE-2026-46748 2026-06-09 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allo…
CVE-2026-11167 2026-06-04 Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape vi…
CVE-2026-10843 2026-06-04 A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for destructive actions rather than being restr…
CVE-2025-12694 2026-06-04 A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: vers…
CVE-2026-42061 2026-06-03 Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.
CVE-2026-44477 2026-05-28 CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as th…
CVE-2026-3623 2026-05-27 IBM Netezza Performance Server Replication Services 3.0.2.0 through 3.0.5.0 allows an attacker with low‑privileged access to escalate their privileges to root. By exploiting this flaw, the attacker ca…
CVE-2026-8370 2026-05-19 Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 a…
CVE-2026-29205 2026-05-13 Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
CVE-2026-32673 2026-05-13 A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privi…
CVE-2026-32643 2026-05-13 A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arb…
CVE-2026-25710 2026-05-13 The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can chown() arbitrary files in the sys…
CVE-2026-42833 2026-05-12 Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

旧名称

  • Often Misused: Privilege Management (2008-01-30)
  • Design Principle Violation: Failure to Use Least Privilege (2009-01-12)

コンテンツ投稿

名称
7 Pernicious Kingdoms
日付
2006-07-19
バージョン
Draft 3

コンテンツの変更履歴

日付 名称 バージョン 重要度 コメント
2008-09-08 CWE Content Team 1.0 updated Description, Modes_of_Introduction, Relationships, Other_Notes, Relationship_Notes, Taxonomy_Mappings
2008-10-14 CWE Content Team 1.0.1 updated Description, Maintenance_Notes
2009-01-12 CWE Content Team 1.2 updated Common_Consequences, Description, Likelihood_of_Exploit, Maintenance_Notes, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction
2009-03-10 CWE Content Team 1.3 updated Potential_Mitigations
2009-05-27 CWE Content Team 1.4 updated Related_Attack_Patterns
2010-02-16 CWE Content Team 1.8 updated Detection_Factors, Potential_Mitigations, References
2010-06-21 CWE Content Team 1.9 updated Detection_Factors, Potential_Mitigations
2011-03-29 CWE Content Team 1.12 updated Relationships
2011-06-01 CWE Content Team 1.13 updated Common_Consequences, Relationships, Taxonomy_Mappings
2011-06-27 CWE Content Team 2.0 updated Demonstrative_Examples, Relationships
2011-09-13 CWE Content Team 2.1 updated Potential_Mitigations, References, Relationships
2012-05-11 CWE Content Team 2.2 updated References, Related_Attack_Patterns, Relationships
2012-10-30 CWE Content Team 2.3 updated Potential_Mitigations
2013-07-17 CWE Content Team 2.5 updated Applicable_Platforms
2014-02-18 CWE Content Team 2.6 updated Demonstrative_Examples
2014-07-30 CWE Content Team 2.8 updated Detection_Factors
2017-11-08 CWE Content Team 3.0 updated Modes_of_Introduction, References, Relationships
2018-03-27 CWE Content Team 3.1 updated References
2019-01-03 CWE Content Team 3.2 updated Taxonomy_Mappings
2019-09-19 CWE Content Team 3.4 updated Demonstrative_Examples
2020-02-24 CWE Content Team 4.0 updated Applicable_Platforms, Detection_Factors, Observed_Examples, References, Relationships, Type
2022-04-28 CWE Content Team 4.7 updated Observed_Examples
2022-10-13 CWE Content Team 4.9 updated References
2023-01-31 CWE Content Team 4.10 updated Description, Maintenance_Notes, Taxonomy_Mappings
2023-04-27 CWE Content Team 4.11 updated Potential_Mitigations, References, Relationships, Taxonomy_Mappings
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2023-10-26 CWE Content Team 4.13 updated Observed_Examples
2025-09-09 CWE Content Team 4.18 updated Common_Consequences, Description, Detection_Factors, Diagram, Other_Notes, References
2025-12-11 CWE Content Team 4.19 updated Maintenance_Notes, Weakness_Ordinalities
2026-04-30 CWE Content Team 4.20 updated Alternate_Terms, Applicable_Platforms, Modes_of_Introduction, References, Relationships

貢献

タイプ 名称 日付 コメント
Content "Mapping CWE to 62443" Sub-Working Group 2023-01-24 Suggested mappings to ISA/IEC 62443.
Content "Mapping CWE to 62443" Sub-Working Group 2023-04-25 Suggested mappings to ISA/IEC 62443.
cvelogic Threat Intelligence