Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.6
Improper access control in some Intel(R) Optane(TM) PMem software before versions 01.00.00.3547, 02.00.00.3915, 03.00.0…
-
Medium 6.7
Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 ma…
-
High 7.1
Improper access control for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 …
-
Medium 6.7
Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authentica…
-
Medium 6.1
Improper access control in firmware for some Intel(R) Thunderbol(TM) Controllers versions before 41 may allow a privile…
-
Low 3.8
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Low 2.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Medium 4.2
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Medium 5.0
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Medium 5.5
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
Medium 6.3
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
High 7.9
Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authent…
-
High 8.2
Improper access control in the Intel(R) Thunderbolt(TM) DCH drivers for Windows may allow an authenticated user to pote…
-
High 7.8
In Dell SupportAssist for Home PCs (between v3.0 and v3.14.1) and SupportAssist for Business PCs (between v3.0 and v3.4…
-
Critical 9.8
4ipnet EAP-767 v3.42.00 is vulnerable to Incorrect Access Control. The device uses the same set of credentials, regardl…
-
Medium 4.3
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (al…
-
High 7.1
Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in …
-
Low 3.4
Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access t…
-
High 7.1
Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leadi…
-
Medium 6.0CVE-2023-31346 Public exploit
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
-
Medium 4.3
Broken Access Control in Backend Module in sf_event_mgt
sf_event_mgt is an event management and registration extension for the TYPO3 CMS based on ExtBase and Fluid. In affected versions the existing access control check for events in the backend module got broken during the update of the extension to TYPO3 12.4, b…
-
Critical 9.0
Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
-
Critical 9.3
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
-
Medium 5.7
Skype for Business Information Disclosure Vulnerability
Skype for Business Information Disclosure Vulnerability
-
Critical 9.8
Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
-
Medium 6.5
Inadequate access control vulnerability in Moodle
Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their…
-
Low 3.1
Incorrect Authorization leads to Channel Member Count Leak
Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.
-
High 8.8
In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly…
-
Critical 10.0
OpenObserve Privilege Escalation Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular…
-
Critical 9.1
OpenObserve Unauthorized Access Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any a…
-
Medium 5.3
Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API
The Simple Page Access Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's page restriction…
-
Critical 9.8
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php…
-
High 8.8
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster co…
-
High 7.7
Open Forms potential multi-factor authentication bypass
Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially …
-
Medium 5.3
Elastic Network Drive Connector Improper Access Control
An issue was discovered in the Windows Network Drive Connector when using Document Level Security to assign permissions to a file, with explicit allow write and deny read. Although the document is not accessible to the user in Network Drive it is visible in s…
-
Medium 6.5
Kibana Broken Access Control issue
An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API ma…
-
Medium 6.7
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 …
-
High 8.4
Improper Access Control in Automotive Multimedia
Memory corruption in Automotive Multimedia due to improper access control in HAB.
-
Medium 5.3
ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
The ARMember plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.21 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Default Restriction" feature and view…
-
Medium 4.3
Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via save_view
The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'save_view' …