Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 7.5
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the…
KEV Jul 20, 2023 -
Medium 5.3
ColdFusion | Improper Access Control (CWE-284)
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the…
-
Medium 5.8
A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR…
-
Medium 4.2
An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.…
-
Unscored —
netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. There is a file leak in the website source code of the …
-
Medium 6.8
Improper access control
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the local network. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity and availability.
-
Medium 4.9
Cold Rest Vulnerabiltiy
AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper access control via the physical network. A successful exploit of this vulnerability may lead to a loss of confidentiality.
-
High 7.1
A vulnerability has been identified in QMS Automotive (All versions < V12.39). The QMS.Mobile module of the affected ap…
-
High 7.3
SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A low-privileged malicious …
-
Unscored —
An issue was discovered on ARRIS TG852G, TG862G, and TG1672G devices. A remote attacker (in proximity to a Wi-Fi networ…
-
Unscored —CVE-2023-37759 Public exploit
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthentica…
-
High 7.2
2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1
A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds f…
-
High 7.4
ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation
ColdFusion version 2021 update 1 (and earlier) and versions 2018.10 (and earlier) are impacted by an improper access control vulnerability when checking permissions in the CFIDE path. An authenticated attacker could leverage this vulnerability to access and m…
-
Medium 6.9
An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a r…
-
High 7.2
Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authen…
-
High 8.1
An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform …
-
Critical 9.8CVE-2023-4696 Public exploit
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
-
Medium 4.7
Improper Access Control in instantsoft/icms2
Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
-
Medium 6.5
Set Logging Level Without Authentication
The controller responsible for setting the logging level does not include any authorization checks to ensure the user is authenticated. This can be seen by noting that it extends Controller rather than AuthenticatedController and includes no further checks. T…
-
Medium 4.6
cross-site inclusion (XSSI) of files in jupyter-server
jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been…
-
Low 3.5
Byzoro Smart S85F Management Platform licence.php access control
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230816. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /sysmanage/licence.php. The manipulation leads to improper access co…
-
Medium 6.5
OpenFGA Authorization Bypass
OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. The vulnerability affects customers using …
-
Critical 9.1
XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifyi…
-
Medium 6.7
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local…
-
Medium 5.4
A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller …
-
Unscored —
LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allow…
-
Unscored —
Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists.
-
Unscored —
Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3
Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows the unauthorized removal of attachments from campaigns.
-
Unscored —
lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.
-
High 7.5
PowerJob incorrect access control vulnerability
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.
-
High 7.8
A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an …
-
Medium 4.3
A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access inter…
-
Medium 6.7
Incorrect authorization allows a user manager to update a system admin
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.
-
Medium 6.3
A guest user can perform various actions on public playbooks
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.
-
Low 3.1
Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message
-
Medium 5.0
Improper access control in the Intel Unite(R) android application before version 4.2.3504 may allow an authenticated us…
-
Medium 6.0
Improper access control in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of …
-
High 7.3
Improper access control in some Intel(R) Unison(TM) software before version 10.12 may allow a privileged user to potent…
-
Medium 6.7
Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may …
-
High 8.2
Improper access control in firmware for some Intel(R) PROSet/Wireless WiFi software for Windows before version 22.220 H…