Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

Architecture and Design, Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

3,450 results · Clear filters · Feed

Medium 4.3

CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…

jfrog JFrog Artifactory

Mar 2, 2022
Medium 4.1

CVE-2021-3967

Improper Access Control in zulip/zulip

Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

zulip zulip/zulip

Feb 26, 2022
Medium 5.3

CVE-2020-14504

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, un…

Rockwell Automation 1734-AENTR ICS / OT

Feb 24, 2022
Medium 5.4

CVE-2022-0731

Improper Access Control (IDOR) in dolibarr/dolibarr

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist

Feb 23, 2022
Medium 5.4

CVE-2022-0727

Improper Access Control in chocobozzz/peertube

Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

Chocobozzz chocobozzz/peertube

Feb 23, 2022
Medium 4.3

CVE-2022-23981

WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

quadlayers Perfect Brands for WooCommerce (WordPress plugin) Web / CMS

Feb 18, 2022
Medium 4.0

CVE-2022-24923

Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrust…

Samsung Mobile SearchWidget

Feb 11, 2022
Medium 4.0

CVE-2022-23997

Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2…

Samsung Mobile Samsung Wearable Devices

Feb 11, 2022
Medium 4.0

CVE-2022-23996

Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release a…

Samsung Mobile Samsung Wearable Devices

Feb 11, 2022
Medium 4.0

CVE-2022-23995

Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Rele…

Samsung Mobile Samsung Wearable Devices

Feb 11, 2022
Medium 4.3

CVE-2022-23433

Improper access control vulnerability in Reminder prior to versions 12.3.01.3000 in Android S(12), 12.2.05.6000 in Andr…

Samsung Mobile Reminder

Feb 11, 2022
Medium 6.5

CVE-2020-13676

Incorrect Authorization in Drupal core

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

Drupal Core drupal/core Packagist

Feb 11, 2022
Medium 5.5

CVE-2022-21816

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can …

NVIDIA NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming

Feb 7, 2022
Medium 6.1

CVE-2022-21813

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insuffici…

NVIDIA NVIDIA GPU Display Driver nvidia-graphics-drivers-304 nvidia-graphics-drivers-340 Debian Ubuntu

Feb 7, 2022
Medium 5.3

CVE-2022-23600

Limited ability to spoof SAML authentication with missing audience verification

fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or com…

fleetdm fleet github.com/fleetdm/fleet/v4 Go

Feb 4, 2022
Medium 4.3

CVE-2022-0273

Improper Access Control in janeczku/calibre-web

Improper Access Control in Pypi calibreweb prior to 0.6.16.

janeczku janeczku/calibre-web calibreweb PyPI

Jan 30, 2022
Medium 5.3

CVE-2021-40404

An authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_2…

Jan 28, 2022
Medium 4.0

CVE-2021-4016

Rapid7 Insight Agent Improper Access Control

Rapid7 Insight Agent, versions prior to 3.1.3, suffer from an improper access control vulnerability whereby, the user has access to the snapshot directory. An attacker can access, read and copy any of the files in this directory e.g. asset_info.json or file_i…

Rapid7 Insight Agent

Jan 21, 2022
Medium 5.3

CVE-2022-21305

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …

Oracle Java SE JDK and JRE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi

Jan 19, 2022
Medium 5.3

CVE-2022-21291

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). …

Oracle Java SE JDK and JRE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi

Jan 19, 2022
Medium 6.7

CVE-2021-34402

NVIDIA Tegra kernel driver contains a vulnerability in NVIDIA NVDEC, where a user with high privileges might be able to…

NVIDIA SHIELD TV

Jan 18, 2022
Medium 5.5

CVE-2021-28507

An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.

An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.

Arista Networks EOS Network devices

Jan 14, 2022
Medium 6.3

CVE-2022-0178

Missing Authorization in snipe/snipe-it

Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.

snipe snipe/snipe-it snipe/snipe-it Packagist

Jan 13, 2022
Medium 6.3

CVE-2022-0179

Missing Authorization in snipe/snipe-it

snipe-it is vulnerable to Missing Authorization

snipe snipe/snipe-it snipe/snipe-it Packagist

Jan 12, 2022
Medium 5.3

CVE-2022-0170

Improper Access Control in chocobozzz/peertube

peertube is vulnerable to Improper Access Control

Chocobozzz chocobozzz/peertube

Jan 11, 2022
Medium 5.3

CVE-2022-0133

Improper Access Control in chocobozzz/peertube

peertube is vulnerable to Improper Access Control

Chocobozzz chocobozzz/peertube

Jan 7, 2022
Medium 4.3

CVE-2021-4194

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

BookStackApp bookstackapp/bookstack ssddanbrown/bookstack Packagist

Jan 6, 2022
Medium 4.6

CVE-2021-22567

Bidirectional Override in Dart SDK

Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer …

Google Dart SDK

Jan 5, 2022
Medium 5.7

CVE-2021-25991

ifme - Improper Access Control leads to admin deactivation

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.

ifmeorg ifme

Dec 29, 2021
Medium 6.5

CVE-2021-42808

The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.

Improper Access Control in Thales Sentinel Protection Installer could allow a local user to escalate privileges.

Thales Sentinel Protection Installer

Dec 20, 2021
Medium 5.3

CVE-2021-4119 EPSS 27%

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

BookStackApp bookstackapp/bookstack ssddanbrown/bookstack Packagist

Dec 15, 2021
Medium 4.3

CVE-2021-4089

Improper Access Control in snipe/snipe-it

snipe-it is vulnerable to Improper Access Control

snipe snipe/snipe-it snipe/snipe-it Packagist

Dec 10, 2021
Medium 6.5

CVE-2021-22565

Insufficient Granularity of Access Control in GAEN Notification Server

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.

Google Google Exposure-notifications-verification-server github.com/google/exposure-notifications-verification-server Go

Dec 9, 2021
Medium 6.5

CVE-2021-3992

Improper Access Control in kevinpapst/kimai2

kimai2 is vulnerable to Improper Access Control

kevinpapst kevinpapst/kimai2 kevinpapst/kimai2 Packagist

Dec 1, 2021
Medium 6.5

CVE-2021-4026

Improper Access Control in bookstackapp/bookstack

bookstack is vulnerable to Improper Access Control

BookStackApp bookstackapp/bookstack ssddanbrown/bookstack Packagist

Nov 30, 2021
Medium 4.3

CVE-2021-42116

Unauthorized Menu Item Access in TopEase

Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via…

Business-DNA Solutions TopEase

Nov 30, 2021
Medium 6.5

CVE-2021-36917

WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.

wpWave Hide My WP (WordPress plugin) Web / CMS

Nov 24, 2021
Medium 4.9

CVE-2021-40130

Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

A vulnerability in the web application of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog c…

Cisco Cisco Common Services Platform Collector Software Network devices

Nov 18, 2021
Medium 5.5

CVE-2020-12488

Broken Access Control Vulnerability in Jovi Smart Scene

The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands without requesting permission.

vivo Jovi Smart Scene

Nov 10, 2021
Medium 5.7

CVE-2021-25501

An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 a…

Samsung Mobile Samsung Mobile Devices

Nov 5, 2021