Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,449 results · Clear filters · Feed
-
Medium 5.9
Improper Access Control in admidio/admidio
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
-
Medium 6.4
Improper Access Control in admidio/admidio
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
-
Medium 4.3
Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. A…
-
Medium 5.3
CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to …
-
Medium 6.5
Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the 'inc/welcome-screen/…
-
Medium 4.3
JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated …
-
Medium 5.3
JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change th…
-
Medium 4.3
Quick Page/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypass
The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9. This makes it possi…
-
Medium 6.4
404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creation
The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated attackers to view, crea…
-
Medium 4.1
Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the …
-
Medium 4.4
KylinSoft youker-assistant Arbitrary File dbus.SystemBus delete_file access control
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper acc…
-
Medium 5.3
KylinSoft kylin-software-properties changedSource access control
A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. T…
-
Medium 6.2
Improper Access Control in nilsteampassnet/teampass
Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
-
Medium 6.3
SourceCodester Lost and Found Information System access control
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/?page=user/list. The manipulation leads to improper access controls. The attack can…
-
Medium 6.5
Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a u…
-
Medium 4.7
Abstrium Pydio Cells User Creation access control
A vulnerability classified as critical has been found in Abstrium Pydio Cells 4.2.0. This affects an unknown part of the component User Creation Handler. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The e…
-
Medium 4.6
kyverno seccomp control can be circumvented
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
-
Medium 6.3
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
Medium 6.3
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is p…
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=1681813520783&rows=10000&page=1&…
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=1680855479750&rows=50&page=1&si…
-
Medium 6.7
Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to p…
-
Medium 6.3
SourceCodester Lost and Found Information System access control
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/?page=user/manage_user. The manipulation leads to improper access controls. The atta…
-
Medium 4.4
Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to p…
-
Medium 4.8
Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated us…
-
Medium 6.7
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user t…
-
Medium 5.0
Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an …
-
Medium 6.7
Improper access control for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user …
-
Medium 5.8
Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of…
-
Medium 5.3
Improper access control in firmware for some Intel(R) NUC Boards, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Perf…
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
Medium 4.7
Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applicatio…
-
Medium 6.8
Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to…
-
Medium 4.4
Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitra…
-
Medium 4.0
Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install…
-
Medium 6.7
Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A …
-
Medium 6.6
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
-
Medium 5.3
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated at…
-
Medium 6.5
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterpris…