Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,450 results · Clear filters · Feed
-
Medium 4.3
Improper access control vulnerability in IImsService prior to SMR Nov-2022 Release 1 allows local attacker to access to…
-
Medium 4.3
Improper access to debug panel in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI…
-
Medium 6.5
"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users wit…
-
Medium 5.5
This issue was addressed with improved entitlements. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able …
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ve…
-
Medium 5.5
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to access…
-
Medium 5.5
An access issue was addressed with additional sandbox restrictions. This issue is fixed in tvOS 16.1, iOS 16.1 and iPad…
-
Medium 6.3
easyii CMS File Upload Management Upload.php file unrestricted upload
A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be init…
-
Medium 6.5
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privi…
-
Medium 6.5
spx_restservice SubNet_handler_func Broken Access Control
A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the security access rights to KVM and Virtual Media functionalities. This issue affects: Lanner Inc IAC-AST2500A standard fir…
-
Medium 5.3
spx_restservice KillDupUsr_func Broken Access Control
A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrarily terminate active sessions of other users, causing a Denial-of-Service (DoS) condition, if an input parameter is correctly guessed. This …
-
Medium 6.5
spx_restservice First_network_func Broken Access Control
A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitrarily change the network configuration of the BMC. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
-
Medium 5.3
spx_restservice FirstReset_handler_func Broken Access Control
A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to arbitrarily send reboot commands to the BMC, causing a Denial-of-Service (DoS) condition. This issue affects: Lanner Inc IAC-AST2500A standa…
-
Medium 5.3
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The …
-
Medium 5.3
Lack of IP address checking in GitLab EE affecting all versions from 14.2 prior to 15.2.5, 15.3 prior to 15.3.4, and 15…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting before 15.1.6, all versions from 15.2 …
-
Medium 5.4
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 15.2.5, all versions starting f…
-
Medium 6.5
An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 befo…
-
Medium 4.3
An improper access control issue in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.4, all versions …
-
Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user'…
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220916.131 contains an improper access control vulnerability. As a result, a malicious actor in a meeting or webinar they are authorized to join could prevent participants from receiving audio and vid…
-
Medium 6.5
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting…
-
Medium 4.9
Malicious agent may be able to impersonate another agent in GoCD
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 can allow one authenticated agent to impersonate another agent, and thus receive w…
-
Medium 6.5
Dell Hybrid Client below 1.8 version contains a guest user profile corruption vulnerability. A WMS privilege attacker c…
-
Medium 4.0
IBM Navigator Mobile Android 3.4.1.1 and 3.4.1.2 app could allow a local user to obtain sensitive information due to im…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 6.4
Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
-
Medium 4.0
Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows atta…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.4
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive info…
-
Medium 4.0
Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bi…
-
Medium 4.0
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitiv…
-
Medium 5.1
Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to co…
-
Medium 4.0
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to…
-
Medium 4.0
Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android …
-
Medium 5.1
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized…
-
Medium 4.0
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attack…
-
Medium 4.0
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows att…