Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,216 results · Clear filters · Feed
-
High 7.8
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…
-
High 7.5
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Offer LOV). Supported versi…
-
High 7.5
Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Finance LOV). Supported ver…
-
High 8.8
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Mana…
-
High 7.5
Dolibarr vulnerable to Cross-Site Request Forgery
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
-
High 8.8
An issue in sanluan PublicCMS v.4.0.202302.e allows an attacker to escalate privileges via the change password function.
-
High 7.5
An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive informatio…
-
High 7.5
Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
-
High 7.5
Broken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
-
High 7.5
Broken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user
-
High 7.5
Broken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field values
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user
-
High 7.5
Broken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user
-
High 8.8
Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
-
High 8.8
Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter…
-
High 7.5
Improper Access Control in gaizhenbiao/chuanhuchatgpt
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sens…
-
High 7.5
WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for …
-
High 8.8
Azure CycleCloud Elevation of Privilege Vulnerability
Azure CycleCloud Elevation of Privilege Vulnerability
-
High 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
Microsoft Defender for IoT Elevation of Privilege Vulnerability
-
High 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
Microsoft Defender for IoT Elevation of Privilege Vulnerability
-
High 7.5
Vulnerability of permission control in the window module. Successful exploitation of this vulnerability may affect conf…
-
High 7.5
Vulnerability of package name verification being bypassed in the HwIms module. Impact: Successful exploitation of this …
-
High 7.5
Vulnerability of insufficient permission verification in the app management module. Impact: Successful exploitation of …
-
High 7.5CVE-2023-36643 Public exploit
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop …
-
High 7.5CVE-2023-36644 Public exploit
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the…
-
High 7.5
Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the s…
-
High 7.2
SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin…
-
High 8.2
An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA …
-
High 8.3
Dell InsightIQ, version 5.0, contains an improper access control vulnerability. A remote low privileged attacker could …
-
High 7.5CVE-2024-25736 Public exploit
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /…
-
High 8.8
Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users …
-
High 7.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this …
KEV Dec 16, 2024 -
High 7.5
Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCrede…
-
High 7.8
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
-
High 7.3
Azure Data Studio Elevation of Privilege Vulnerability
Azure Data Studio Elevation of Privilege Vulnerability
-
High 7.8
Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability
Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability
-
High 7.7
A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.…
-
High 7.8
Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prio…
-
High 8.0
A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providi…
-
High 8.8
An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to …
-
High 7.1
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may b…