Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 7.3
Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious …
-
Medium 4.4
Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malic…
-
High 7.8
NETGEAR ProSAFE Network Management System Privilege Escalation Via MySQL Server
A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYS…
-
Medium 5.8
OroCommerce get-totals-for-checkout API endpoint returns unwanted data
OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.
-
Medium 5.0
OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility
OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security checks. This issue …
-
Medium 5.0
OroCRMCallBundle has incorrect call view page visibility
OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue has been patched in v…
-
Medium 5.0
OroCalendarBundle has incorrect system calendar events visibility
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in…
-
Medium 4.3
Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Mattermost Boards.
-
Medium 4.3
Username and Icon override can be used by members when Hardened Mode is enabled
Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and i…
-
High 7.3
Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious s…
-
High 7.3
Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious …
-
High 7.3
Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local maliciou…
-
High 7.3
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. …
-
High 7.3
Fuji Electric Tellus Lite V-Simulator Improper Access Control
A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system.
-
Low 2.4
Nextcloud Server admins can change authentication details of user configured external storage
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authentication details of …
-
High 8.5
Nextcloud Server users can make external storage mount points inaccessible for other users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0.14.16, 21.0.9.13, 2…
-
High 7.5
CVE-2023-38205 issues | ColdFusion Admin Panel Access
Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the admin…
-
Medium 6.7
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.…
-
Medium 6.7
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.…
-
High 7.3
Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. …
-
High 8.4
Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification…
-
Medium 6.7
Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authentic…
-
Low 3.9
Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated use…
-
High 8.8
Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potenti…
-
High 8.4
Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potenti…
-
Medium 5.5
Improper access control in the Intel Support android application all verions may allow an authenticated user to potenti…
-
Medium 6.8
Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to pote…
-
High 7.5
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.00…
-
High 7.8
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentia…
-
High 8.2
Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.…
-
High 7.5
Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.…
-
Low 1.9
Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of serv…
-
Medium 5.3
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial o…
-
Medium 5.4
Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation…
-
Medium 5.9
Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of …
-
High 7.5
Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial o…
-
High 7.3
Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated u…
-
Medium 4.0
An improper access control vulnerability [CWE-284] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007…
-
High 7.9
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions…
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability