Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
3,450 results · Clear filters · Feed
-
Medium 4.7
Cisco Access Points VLAN Bypass from Native VLAN Vulnerability
A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to …
-
Medium 6.6
AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This i…
-
Medium 4.3
IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they sho…
-
Medium 5.3
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An …
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to byp…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthori…
-
Medium 4.3
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUse…
-
Medium 5.3
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318…
-
Medium 5.3
Jenkins WildFly Deployer Plugin vulnerable to path traversal
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
-
Medium 6.5
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able t…
-
Medium 5.5CVE-2022-32883 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS…
-
Medium 5.7
Contec Health CMS8000
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, t…
-
Medium 6.8
Contec Health CMS8000
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously m…
-
Medium 4.0
Improper access control and intent redirection in Samsung Email prior to 6.1.70.20 allows attacker to access specific f…
-
Medium 6.6
Improper access control vulnerability in ContactsDumpActivity of?Contacts Provider prior to version 12.7.59 allows atta…
-
Medium 4.0
Improper access control in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and b…
-
Medium 5.9
Improper access control vulnerability in Editor Lite prior to version 4.0.40.14 allows attackers to access sensitive in…
-
Medium 4.0
Improper access control vulnerability in Broadcaster in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.…
-
Medium 4.0
Improper access control vulnerability in Telecom application prior to SMR Sep-2022 Release 1 allows attacker to start e…
-
Medium 6.6
Improper restriction of broadcasting Intent in SaWebViewRelayActivity of?Waterplugin prior to version 2.2.11.22081151 a…
-
Medium 5.0
GoCD Windows installations outside default location inadequately restrict installation file permissions
GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local…
-
Medium 5.3
canna: unsafe handling of /tmp/.iroha_unix directory
A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior t…
-
Medium 5.3
Improper Access Control in jgraph/drawio
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
-
Medium 5.5
An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Monterey 12.5, macOS Big S…
-
Medium 4.4
Kernel: security regression for cve-2018-13405
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…
-
Medium 6.6
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and…
-
Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the…
-
Medium 6.3
Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An attacker with no…
-
Medium 6.5
Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability in UI. An remote authentic…
-
Medium 4.3
Dell Wyse Management Suite 3.6.1 and below contains an Improper Access control vulnerability with which an attacker wit…
-
Medium 5.4CVE-2022-36923 Scanner template
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall A…
-
Medium 5.3
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE W…
-
Medium 5.8
This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches t ...
This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet…
-
Medium 4.3
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, users viewing the grade history report without the 'access all groups'…
-
Medium 4.0
Improper access control vulnerability in WebApp in Cameralyzer prior to versions 3.2.22, 3.3.22, 3.4.22 and 3.5.51 allo…
-
Medium 5.1
Improper access control vulnerability in DesktopSystemUI prior to SMR Aug-2022 Release 1 allows attackers to enable and…
-
Medium 6.2
Improper access control vulnerability in SemWifiApBroadcastReceiver prior to SMR Aug-2022 Release 1 allows attacker to …
-
Medium 6.3
SourceCodester Garage Management System createUser.php access control
A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This issue affects some unknown processing of the file /php_action/createUser.php. The manipulation leads to improper access controls. The attack…