Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 8.3
MySQL Connectors takeover vulnerability
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.1.0 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to …
-
Low 3.7
Exposure of poll options and votes to unauthorized users in Discourse
Discourse is an open source platform for community discussion. Attackers with details specific to a poll in a topic can use the `/polls/grouped_poll_results` endpoint to view the content of options in the poll and the number of votes for groups of poll partic…
-
Unscored —
An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2…
-
Unscored —
Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with pe…
-
High 7.3
Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. A…
-
Medium 5.4
vantage6 Improper Access Control vulnerability
vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/{id}/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the t…
-
Critical 9.8
An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A spec…
-
High 8.8
A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108.…
-
Unscored —
Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect …
-
High 7.8
Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability
-
High 7.3
Azure DevOps Server Elevation of Privilege Vulnerability
Azure DevOps Server Elevation of Privilege Vulnerability
-
Medium 4.4
Active Directory Domain Services Information Disclosure Vulnerability
Active Directory Domain Services Information Disclosure Vulnerability
-
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
-
High 7.8
Win32k Elevation of Privilege Vulnerability
Win32k Elevation of Privilege Vulnerability
-
High 7.7
An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 thro…
-
Medium 6.5
An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a res…
-
Medium 6.7
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …
-
Unscored —
HP LIFE Android Mobile – Potential Escalation of Privilege, Information Disclosure
HP LIFE Android Mobile application is potentially vulnerable to escalation of privilege and/or information disclosure.
-
Medium 4.8
micronaut security has invalid IdTokenClaimsValidator logic on aud
Micronaut Security is a security solution for applications. Prior to versions 3.1.2, 3.2.4, 3.3.2, 3.4.3, 3.5.3, 3.6.6, 3.7.4, 3.8.4, 3.9.6, 3.10.2, and 3.11.1, IdTokenClaimsValidator skips `aud` claim validation if token is issued by same identity issuer/pro…
-
High 8.2
Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary file…
-
Critical 9.1
Decidim has broken access control in templates
Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in u…
-
Medium 4.4
Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. A lo…
-
Medium 6.8
Improper authorization check in the server component
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
-
High 8.1
If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users…
-
High 8.8
ByDemes Group Airspace CCTV Web Service Improper Access Control
The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.
-
High 8.1
Improper Access Control in salesagility/suitecrm
Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.
-
High 8.4
Improper Access Control in Core
Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.
-
High 8.7
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
-
Medium 6.5
FlashArray pgroup Retention Lock SafeMode Protection
A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.
-
Medium 6.5
FlashBlade Object Store Privileged Access
A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.
-
Critical 9.8
A remote unauthorized attacker may connect to the SIM1012, interact with the device and change configuration settings. …
-
High 7.8
Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability. A local low-…
-
High 8.6
A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a reposi…
-
High 7.3
Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerab…
-
Medium 4.9
Privilege Escalation from technician to super-admin in GLPI
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change…
-
Medium 6.5
SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network
SiberianCMS - CWE-284 Improper Access Control Authorized user may disable a security feature over the network
-
Unscored —
Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause an app to…
-
Unscored —
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
-
High 7.5
NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI i…
-
Critical 9.4
Improper Access Control in Ormazabal products
Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing user…