Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,449 results · Clear filters · Feed
-
Medium 4.6
Improper Access Control in francoisjacquet/rosariosis
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
-
Medium 5.3
PowerJob Incorrect Access Control vulnerability
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
-
Medium 5.5
Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This…
-
Medium 5.3
PowerJob vulnerable to Incorrect Access Control via the create user/save interface.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
-
Medium 5.0
Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulner…
-
Medium 6.7
Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1…
-
Medium 6.8
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…
-
Medium 6.1
Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (compo…
-
Medium 6.5
Users can set up workflows using restricted and invisible system tags in Nextcloud
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It …
-
Medium 5.4
Improper Access Control in alextselegidis/easyappointments
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
Medium 6.5
Azure Machine Learning Information Disclosure Vulnerability
Azure Machine Learning Information Disclosure Vulnerability
-
Medium 4.3
Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypas…
-
Medium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting f…
-
Medium 5.4
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Medium 5.7
User without download rights can download older version of that file in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.…
-
Medium 5.7
Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recomme…
-
Medium 5.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-…
-
Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a us…
-
Medium 4.2
directus vulnerable to Insertion of Sensitive Information into Log File
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…
-
Medium 4.3
Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
-
Medium 4.3
Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
Medium 6.3
SourceCodester E-Commerce System Username access control
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipula…
-
Medium 4.4
Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls.…
-
Medium 4.4
Max Secure Anti Virus Plus IoControlCode SDActMon.sys 0x220020 access control
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls…
-
Medium 4.4
Lespeed WiseCleaner Wise Force Deleter IoControlCode WiseUnlock64.sys 0x220004 access control
A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper…
-
Medium 4.4
Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control
A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access contr…
-
Medium 4.1
Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bl…
-
Medium 4.0
Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in …
-
Medium 5.5
Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applicat…
-
Medium 5.5
Sensitive Information Disclosure in ClearPass OnGuard Ubuntu Agent
A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to retrieve information th…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which wi…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned …
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions startin…
-
Medium 6.5
XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm
XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no work…
-
Medium 6.5
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to …
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2,…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.…
-
Medium 5.7
Nextcloud download permissions can be changed by resharer
Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. …