1559
Example Language: Shell (Good)
gsutil iam ch -d allUsers gs://BUCKET_NAME
gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME
Observed Examples
Reference Description
CVE-2022-29527 Go application for cloud management creates a world-writable sudoers file that
allows local attackers to inject sudo rules and escalate privileges to root by
winning a race condition.
https://www.cve.org/CVERecord?id=CVE-2022-29527
CVE-2009-3482 Anti-virus product sets insecure "Everyone: Full Control" permissions for files
under the "Program Files" folder, allowing attackers to replace executables
with Trojan horses.
https://www.cve.org/CVERecord?id=CVE-2009-3482
CVE-2009-3897 Product creates directories with 0777 permissions at installation, allowing
users to gain privileges and access a socket used for authentication.
https://www.cve.org/CVERecord?id=CVE-2009-3897
CVE-2009-3489 Photo editor installs a service with an insecure security descriptor, allowing
users to stop or start the service, or execute commands as SYSTEM.
https://www.cve.org/CVERecord?id=CVE-2009-3489
CVE-2020-15708 socket created with insecure permissions
https://www.cve.org/CVERecord?id=CVE-2020-15708
CVE-2009-3289 Library function copies a file to a new target and uses the source file's
permissions for the target, which is incorrect when the source file is a symbolic
link, which typically has 0777 permissions.
https://www.cve.org/CVERecord?id=CVE-2009-3289
CVE-2009-0115 Device driver uses world-writable permissions for a socket file, allowing
attackers to inject arbitrary commands.
https://www.cve.org/CVERecord?id=CVE-2009-0115
CVE-2009-1073 LDAP server stores a cleartext password in a world-readable file.
https://www.cve.org/CVERecord?id=CVE-2009-1073
CVE-2009-0141 Terminal emulator creates TTY devices with world-writable permissions,
allowing an attacker to write to the terminals of other users.
https://www.cve.org/CVERecord?id=CVE-2009-0141
CVE-2008-0662 VPN product stores user credentials in a registry key with "Everyone: Full
Control" permissions, allowing attackers to steal the credentials.
https://www.cve.org/CVERecord?id=CVE-2008-0662
CVE-2008-0322 Driver installs its device interface with "Everyone: Write" permissions.
https://www.cve.org/CVERecord?id=CVE-2008-0322
CVE-2009-3939 Driver installs a file with world-writable permissions.
https://www.cve.org/CVERecord?id=CVE-2009-3939
CVE-2009-3611 Product changes permissions to 0777 before deleting a backup; the
permissions stay insecure for subsequent backups.
https://www.cve.org/CVERecord?id=CVE-2009-3611
CVE-2007-6033 Product creates a share with "Everyone: Full Control" permissions, allowing
arbitrary program execution.
https://www.cve.org/CVERecord?id=CVE-2007-6033
CVE-2007-5544 Product uses "Everyone: Full Control" permissions for memory-mapped files
(shared memory) in inter-process communication, allowing attackers to tamper
with a session.
https://www.cve.org/CVERecord?id=CVE-2007-5544
CVE-2005-4868 Database product uses read/write permissions for everyone for its shared
memory, allowing theft of credentials.
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource