Common Weakness Enumeration

CWE-529

Weakness Allowed

Exposure of Access Control List Files to an Unauthorized Control Sphere

Abstraction: Variant · Status: Incomplete

The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.

Mapping guidance

This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members

ChildOf: CWE-552 · View CWE-1000

Modes of introduction

Operation

OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.

Content history

Submission: Anonymous Tool Vendor (under NDA) · 2006-07-19 · CWE Draft 3

Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Potential_Mitigations, Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2009-03-10 · CWE 1.3

updated Relationships

Modification: CWE Content Team · MITRE · 2009-12-28 · CWE 1.7

updated Description, Name

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Modes_of_Introduction, Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Common_Consequences, Description

2 vulnerabilities reference this CWE, most recent first.

CVE-2014-0752 (GCVE-0-2014-0752)

Vulnerability from cvelistv5 – Published: 2014-01-09 11:00 – Updated: 2025-08-22 22:53

Title

Ecava IntegraXor Exposure of Access Control List Files to an Unauthorized Control Sphere

Summary

The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.

Severity

No CVSS data available.

CWE

CWE-529

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 352 records in the last 180 days details

References

3 references

URL	Tags
http://www.integraxor.com/blog/category/security/…	x_refsource_CONFIRM
https://www.cisa.gov/news-events/ics-advisories/i…
http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01	x_refsource_MISCx_transferred

Impacted products

1 product

Vendor	Product	Version
Ecava	IntegraXor	Affected: 0 , ≤ 4.1.4360 (custom)

Date Public

2013-12-21 07:00

Credits

Zero Day Initiative

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:27:19.460Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.integraxor.com/blog/category/security/vulnerability-note/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IntegraXor",
          "vendor": "Ecava",
          "versions": [
            {
              "lessThanOrEqual": "4.1.4360",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zero Day Initiative"
        }
      ],
      "datePublic": "2013-12-21T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.\u003c/p\u003e"
            }
          ],
          "value": "The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-529",
              "description": "CWE-529",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-22T22:53:01.252Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.integraxor.com/blog/category/security/vulnerability-note/"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-008-01"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEcava Sdn Bhd has issued a customer notification that details this \nvulnerability and provides mitigations to its customers. Ecava Sdn Bhd \nrecommends users download and install the update, IntegraXor SCADA \nServer 4.1.4369, from their support Web site:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.integraxor.com/download/beta.msi?4.1.4369\"\u003ehttp://www.integraxor.com/download/beta.msi?4.1.4369\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor additional information, please see Ecava\u2019s vulnerability note:\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.integraxor.com/blog/category/security/vulnerability-note/\"\u003ehttp://www.integraxor.com/blog/category/security/vulnerability-note/\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Ecava Sdn Bhd has issued a customer notification that details this \nvulnerability and provides mitigations to its customers. Ecava Sdn Bhd \nrecommends users download and install the update, IntegraXor SCADA \nServer 4.1.4369, from their support Web site:\u00a0 http://www.integraxor.com/download/beta.msi?4.1.4369 \n\nFor additional information, please see Ecava\u2019s vulnerability note:\u00a0 http://www.integraxor.com/blog/category/security/vulnerability-note/"
        }
      ],
      "source": {
        "advisory": "ICSA-14-008-01",
        "discovery": "EXTERNAL"
      },
      "title": "Ecava IntegraXor Exposure of Access Control List Files to an Unauthorized Control Sphere",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-0752",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.integraxor.com/blog/category/security/vulnerability-note/",
              "refsource": "CONFIRM",
              "url": "http://www.integraxor.com/blog/category/security/vulnerability-note/"
            },
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-0752",
    "datePublished": "2014-01-09T11:00:00.000Z",
    "dateReserved": "2014-01-02T00:00:00.000Z",
    "dateUpdated": "2025-08-22T22:53:01.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-RVWG-J89R-C4VW

Vulnerability from github – Published: 2022-05-17 04:54 – Updated: 2025-08-23 00:31

Details

The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-0752"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-529"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-01-09T18:07:00Z",
    "severity": "MODERATE"
  },
  "details": "The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL.",
  "id": "GHSA-rvwg-j89r-c4vw",
  "modified": "2025-08-23T00:31:12Z",
  "published": "2022-05-17T04:54:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0752"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-008-01"
    },
    {
      "type": "WEB",
      "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-008-01"
    },
    {
      "type": "WEB",
      "url": "http://www.integraxor.com/blog/category/security/vulnerability-note"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

Mitigation

System Configuration

Protect access control list files.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list