604
Reference Description
CVE-2008-1877 Program runs with privileges and calls another program with the same
privileges, which allows read of arbitrary files.
https://www.cve.org/CVERecord?id=CVE-2008-1877
CVE-2007-5159 OS incorrectly installs a program with setuid privileges, allowing users to gain
privileges.
https://www.cve.org/CVERecord?id=CVE-2007-5159
CVE-2008-4638 Composite: application running with high privileges (CWE-250) allows user to
specify a restricted file to process, which generates a parsing error that leaks
the contents of the file (CWE-209).
https://www.cve.org/CVERecord?id=CVE-2008-4638
CVE-2008-0162 Program does not drop privileges before calling another program, allowing
code execution.
https://www.cve.org/CVERecord?id=CVE-2008-0162
CVE-2008-0368 setuid root program allows creation of arbitrary files through command line
argument.
https://www.cve.org/CVERecord?id=CVE-2008-0368
CVE-2007-3931 Installation script installs some programs as setuid when they shouldn't be.
https://www.cve.org/CVERecord?id=CVE-2007-3931
CVE-2020-3812 mail program runs as root but does not drop its privileges before attempting
to access a file. Attacker can use a symlink from their home directory to a
directory only readable by root, then determine whether the file exists based on
the response.
https://www.cve.org/CVERecord?id=CVE-2020-3812
CVE-2003-0908 Product launches Help functionality while running with raised privileges,
allowing command execution using Windows message to access "open file"
dialog.
https://www.cve.org/CVERecord?id=CVE-2003-0908
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 753 2009 Top 25 - Porous Defenses 750 2353
MemberOf 815 OWASP Top Ten 2010 Category A6 - Security
Misconfiguration
809 2358
MemberOf 858 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 15 - Serialization (SER)
844 2368
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Relationship
There is a close association with CWE-653 (Insufficient Separation of Privileges). CWE-653 is
about providing separate components for each privilege; CWE-250 is about ensuring that each
component has the least amount of privileges possible.
Maintenance
CWE Version 4.14
CWE-250: Execution with Unnecessary Privileges
CWE-250: Execution with Unnecessary Privileges