Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.3
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability classified as problematic has been found in NFine Rapid Development Platform 20230511. This affects an unknown part of the file /SystemManage/Role/GetGridJson?keyword=&page=1&rows=20. The manipulation leads to improper access controls. It is p…
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /SystemManage/Organize/GetTreeGridJson?_search=false&nd=1681813520783&rows=10000&page=1&…
-
Medium 4.3
NFine Rapid Development Platform access control
A vulnerability was found in NFine Rapid Development Platform 20230511. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /SystemManage/User/GetGridJson?_search=false&nd=1680855479750&rows=50&page=1&si…
-
Low 2.7
Liferay portal has unauthorized access to object definition via search
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from …
-
Low 2.7
Liferay portal unauthorized access to objects via OAuth 2 scope
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different vi…
-
High 7.8
runAsNonRoot logic bypass for Windows containers
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
-
High 8.8
Improper Access Control in cloudexplorer-dev/cloudexplorer-lite
Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0.
-
High 7.5
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122…
-
High 7.5
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122…
-
High 7.1
Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user …
-
High 7.1
Improper access control in the Intel(R) Server Board S2600WTT belonging to the Intel(R) Server Board S2600WT Family wit…
-
Medium 6.7
Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to p…
-
Medium 6.3
SourceCodester Lost and Found Information System access control
A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/?page=user/manage_user. The manipulation leads to improper access controls. The atta…
-
High 8.8
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
-
Critical 9.4
Rockwell Automation Kinetix 5500 Vulnerable to Open Port Exploitation
Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default. This could potentially allow attackers unauthorized access to the device thr…
-
Low 3.1
Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may all…
-
Medium 4.4
Improper access control in the Intel(R) Unite(R) android application before Release 17 may allow a privileged user to p…
-
Medium 4.8
Improper access control in the Intel(R) Connect M Android application before version 1.82 may allow an authenticated us…
-
Low 3.3
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user t…
-
Medium 6.7
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user t…
-
High 7.2
Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileg…
-
High 8.2
Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potenti…
-
High 8.8
Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow an authent…
-
Medium 5.0
Improper access control in the Intel(R) Retail Edge android application before version 3.0.301126-RELEASE may allow an …
-
High 7.1
Improper access control in the Intel(R) Retail Edge Mobile iOS application before version 3.4.7 may allow an authentica…
-
Medium 6.7
Improper access control for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user …
-
Medium 5.8
Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable denial of…
-
Medium 5.3
Improper access control in firmware for some Intel(R) NUC Boards, Intel(R) NUC 11 Performance Kit, Intel(R) NUC 11 Perf…
-
High 7.2
Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalatio…
-
High 7.8
Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
High 7.1
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…
-
High 8.5
Improper access control vulnerability in ThemeManager prior to SMR May-2023 Release 1 allows local attackers to write a…
-
Medium 4.7
Improper access control in GearManagerStub prior to SMR May-2023 Release 1 allows a local attacker to delete applicatio…
-
Medium 6.8
Improper access control vulnerability in SemShareFileProvider prior to SMR May-2023 Release 1 allows local attackers to…
-
Medium 4.4
Improper access control vulnerablility in Tips prior to SMR May-2023 Release 1 allows local attackers to launch arbitra…
-
Medium 4.0
Improper access control vulnerability in Knox Enrollment Service prior to SMR May-2023 Release 1 allow attacker install…
-
Medium 6.7
Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A …
-
High 8.4
Improper Access Control in HAB Memory Management
Memory corruption in HAB Memory management due to broad system privileges via physical address.