Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.6
Improper access control in some Intel(R) ISPC software installers before version 1.19.0 may allow an authenticated user…
-
High 7.3
Improper access control in some Intel(R) VROC software before version 8.0.0.4035 may allow an authenticated user to pot…
-
Medium 6.0
Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to pote…
-
High 7.5
Improper access control in the Intel(R) Unite(R) Hub software installer for Windows before version 4.2.34962 may allow …
-
High 7.2
Improper access control in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially en…
-
Low 3.3
Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of …
-
Medium 5.6
Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an un…
-
Medium 6.7
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated us…
-
High 7.9
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user…
-
High 8.2
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a privileged user…
-
Low 3.8
Business Logic Errors in froxlor/froxlor
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.22,2.1.0.
-
High 7.2
2FA/MFA Bypass Vulnerability in Serv-U 15.4
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
-
High 8.1
Missing password confirmation when creating app passwords
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 20.0.0 and prior to versions 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a missing password confirmation allowed …
-
High 7.7
Users can delete external storage mount points
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delet…
-
Low 3.5
Text does not respect "Allow download" permissions
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 24.0.4 and prior to versions 25.0.9, 26.0.4, and 27.0.1, when a folder with images or an image was shared without download permissions, the user could add…
-
Low 3.5
Existence of calendars and address books can be checked by unauthenticated users
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.9, 26.0.4, and 27.0.1, unauthenticated users could send a DAV request which reveals whether a calendar or an address boo…
-
Medium 6.5
Advanced permissions not respected when copying entire group folders
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder acc…
-
Medium 6.5
Microsoft SharePoint Server Information Disclosure Vulnerability
Microsoft SharePoint Server Information Disclosure Vulnerability
-
High 7.2
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
-
Medium 5.5
Windows Group Policy Security Feature Bypass Vulnerability
Windows Group Policy Security Feature Bypass Vulnerability
-
High 8.1
Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, includ…
-
Medium 4.3
SourceCodester Inventory Management System Password edit_update.php access control
A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file edit_update.php of the component Password Handler. The manipulation of the argument user_id lea…
-
Medium 6.3
Ruijie RG-EW1200G Administrator Password set_passwd access control
A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to …
-
High 7.6
Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. A remote read only use…
-
High 7.5CVE-2023-37478 Public exploit
pnpm incorrectly parses tar archives relative to specification
pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on t…
-
Unscored —
Incomplete verification of installation file signature
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
-
Medium 4.3
Aures Komet Kiosk Mode access control
A vulnerability classified as problematic has been found in Aures Komet up to 20230509. This affects an unknown part of the component Kiosk Mode. The manipulation leads to improper access controls. It is possible to launch the attack on the physical device. T…
-
Critical 9.1CVE-2023-34034 Public exploit
Access Control Bypass in Spring Security
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
-
High 8.4
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
High 7.5
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
Umbraco is a ASP.NET CMS. Under rare conditions a restart of Umbraco can allow unauthorized users access to admin-level permissions. This vulnerability was patched in versions 10.6.1, 11.4.2 and 12.0.1.
-
High 7.5
Adobe ColdFusion Improper Access Control Security feature bypass
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to a…
KEV Jul 20, 2023 -
High 7.8
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
-
Critical 9.9
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper acce…
-
Critical 9.8
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…
KEV Aug 16, 2023 -
Medium 6.3
Users with only access to launch VDA applications can launch an unauthorized desktop
Users with only access to launch VDA applications can launch an unauthorized desktop
-
Medium 5.5
Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applications
A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able to gain access to the Citrix Virtual Apps and Desktops session of another user who is using the same computer from which …
-
High 7.5
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to affect the availability …
-
High 8.2
Improper Access Control in the SICK ICR890-4 could allow an unauthenticated remote attacker to gather information about…
-
High 7.5
GLPI vulnerable to unauthenticated access to Dashboard data
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this i…