The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
This may allow the resource to be manipulated by actors outside of the intended control sphere.
Periodically review the privileges and their owners.
An attacker could read and modify data for which they do not have permissions to access directly.
Use automated tools to check for privilege settings.
CVE-2024-43199product installs binaries with potentially insecure user/group ownership
CVE-2007-5101File system sets wrong ownership and group when creating a new file.
CVE-2007-4238OS installs program with bin owner/group, allowing modification.
CVE-2007-1716Manager does not properly restore ownership of a reusable resource when a user logs out, allowing privilege escalation.
CVE-2005-3148Backup software restores symbolic links with incorrect uid/gid.