Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 8.8
RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php.
-
High 8.5
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
-
High 7.8
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability
-
High 7.5
Loftware Spectrum through 4.6 has unprotected JMX Registry.
-
High 8.2
Vulnerability in Baxter Connex Health Portal
In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
-
High 7.5
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
-
High 7.8
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remo…
-
High 7.5
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using…
-
High 7.5
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--al…
-
High 7.7
SuiteCRM has wrong deletion permission checks on API delete call
SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
-
High 8.1
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low …
-
High 7.3
Powermail TYPO3 extension Broken Access Control in the OutputController
An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configura…
-
High 7.5
An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an a…
-
High 7.5
Microsoft Entra ID Elevation of Privilege Vulnerability
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.
-
High 7.6
Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anony…
-
High 7.2
Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.
-
High 7.5
An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, whic…
-
High 7.5
[20240804] - Core - Improper ACL for backend profile view
Improper Access Controls allows backend users to overwrite their username when disallowed.
-
High 8.8
Improper access control in Linux kernel mode driver for some Intel(R) Ethernet Network Controllers and Adapters before …
-
High 7.9
improper access control in firmware for some Intel(R) FPGA products before version 24.1 may allow a privileged user to …
-
High 7.8
Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated u…
-
High 7.8
Windows Update Stack Elevation of Privilege Vulnerability
Windows Update Stack Elevation of Privilege Vulnerability
-
High 7.8
Azure CycleCloud Remote Code Execution Vulnerability
Azure CycleCloud Remote Code Execution Vulnerability
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Azure Connected Machine Agent Elevation of Privilege Vulnerability
-
High 7.3
Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attack…
-
High 8.1
Kamaji's RBAC Roles for `etcd` are not disjunct
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control…
-
High 8.6
Vonets WiFi Bridges Improper Access Control
Improper access control vulnerability affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enables an unauthenticated remote attacker to bypass authentication and factory reset the device via unprot…
-
High 7.3
Windows Update Stack Elevation of Privilege Vulnerability
Summary Microsoft was notified that an elevation of privilege vulnerability exists in Windows Update, potentially enabling an attacker with basic user privileges to reintroduce previously mitigated vulnerabilities or circumvent some features of Virtualization…
-
High 7.3
Accessing Untrusted Directory May Allow Local Privilege Escalation
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Managemen…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management S…
-
High 7.5
An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kaship…
-
High 8.4
An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted termin…
-
High 8.4
An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal envir…
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
-
High 8.8
A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. This flaw allows authenticated user…
-
High 7.5
An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allo…