Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,449 results · Clear filters · Feed
-
Medium 4.8
An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability t…
-
Medium 4.3
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticat…
-
Medium 6.0
Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a dev…
-
Medium 4.4
Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malic…
-
Medium 5.8
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
-
Medium 5.0
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue …
-
Medium 5.0
OroCRMCallBundle has incorrect call view page visibility
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in v…
-
Medium 5.0
OroCalendarBundle has incorrect system calendar events visibility
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in…
-
Medium 4.3
Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
-
Medium 4.3
Username and Icon override can be used by members when Hardened Mode is enabled
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and i…
-
Medium 6.7
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.…
-
Medium 6.7
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.…
-
Medium 6.7
Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authentic…
-
Medium 5.5
Improper access control in the Intel Support android application all verions may allow an authenticated user to potenti…
-
Medium 6.8
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to pote…
-
Medium 5.3
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial o…
-
Medium 5.4
Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation…
-
Medium 5.9
Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of …
-
Medium 4.0
An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007…
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 5.7
DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU
Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.
-
Medium 5.3
Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerabili…
-
Medium 4.0
Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitiv…
-
Medium 4.6
Improper Access Control in microweber/microweber
Improper Access Control in GitHub repository microweber/microweber prior to 2.0.
-
Medium 5.5
Vaerys-Dawn DiscordSailv2 Tag access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been rated as critical. Affected by this issue is some unknown functionality of the component Tag Handler. The manipulation leads to improper access controls. Upgrading to version 2.1…
-
Medium 5.5
Vaerys-Dawn DiscordSailv2 Command Mention access control
A vulnerability was found in Vaerys-Dawn DiscordSailv2 up to 2.10.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Command Mention Handler. The manipulation leads to improper access controls. Upg…
-
Medium 6.1
CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.
-
Medium 4.3
Lissy93 Dashy Configuration save access control
A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Configuration Handler. The manipulation of the argument config leads to improper access controls. It i…
-
Medium 4.0
A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially b…
-
Medium 6.5
Sielco Radio Link and Analog FM Transmitters Improper Access Control
The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters.
-
Medium 5.3
Elastic Sharepoint Online Python Connector Improper Access Control
An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user is assigned limited access permissions to an item on a Sharepoint site then that user would have rea…
-
Medium 6.5
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retriev…
-
Medium 5.4
vantage6 Improper Access Control vulnerability
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the t…
-
Medium 4.4
Active Directory Domain Services Information Disclosure Vulnerability
Active Directory Domain Services Information Disclosure Vulnerability
-
Medium 6.5
An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a res…
-
Medium 6.7
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …
-
Medium 4.8
micronaut security has invalid IdTokenClaimsValidator logic on aud
Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/pro…
-
Medium 4.4
Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A lo…
-
Medium 6.8
Improper authorization check in the server component
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
-
Medium 6.5
FlashArray pgroup Retention Lock SafeMode Protection
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.