Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.6
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
-
High 7.8
A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a…
-
High 7.5
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0,…
-
Medium 5.3
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated at…
-
High 7.5
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to val…
-
High 7.4
Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deact…
-
High 7.1
Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authentic…
-
Medium 6.5
Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterpris…
-
High 8.8
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.
On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (refer…
-
Critical 9.8
PowerJob vulnerable to incorrect access control
PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
-
Medium 4.6
Improper Access Control in francoisjacquet/rosariosis
Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.
-
Low 3.6
Desktop component allows lateral movement between sessions
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
-
Critical 9.8
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…
KEV Apr 21, 2023 -
Medium 5.3
PowerJob Incorrect Access Control vulnerability
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
-
Medium 5.5
Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. This…
-
Medium 5.3
PowerJob vulnerable to Incorrect Access Control via the create user/save interface.
PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
-
Medium 5.0
Users can be created even when registration is disabled without validation via the template macro in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. If guest has view right on any document. It's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context. This vulner…
-
Critical 10.0
Async and display macro allow displaying and interacting with any document in restricted mode
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to display or interact with any page a user cannot access through the combination of the async and display macros. A co…
-
High 7.7
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affecte…
-
High 7.1
Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are aff…
-
Low 3.7
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)…
-
Medium 6.7
Vulnerability in Oracle SQL Developer (component: Installation). Supported versions that are affected are Prior to 23.1…
-
High 8.3
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…
-
Medium 6.8
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). Su…
-
Medium 6.1
Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (compo…
-
Medium 6.5
Users can set up workflows using restricted and invisible system tags in Nextcloud
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It …
-
Medium 5.4
Improper Access Control in alextselegidis/easyappointments
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0.
-
High 7.8
ZDI-CAN-20712: Net.HTTP.request URL restriction bypass
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…
-
High 7.8
ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass Vulnerability
Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requi…
-
Medium 6.5
Azure Machine Learning Information Disclosure Vulnerability
Azure Machine Learning Information Disclosure Vulnerability
-
High 7.8
Windows Registry Elevation of Privilege Vulnerability
Windows Registry Elevation of Privilege Vulnerability
-
High 7.5
Azure Service Connector Security Feature Bypass Vulnerability
Azure Service Connector Security Feature Bypass Vulnerability
-
Critical 9.1
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the…
-
High 8.1
Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific …
-
Medium 4.3
Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypas…
-
High 7.8
Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attack…
-
Medium 5.8
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting f…
-
Medium 5.4
Improper Access Control in thorsten/phpmyfaq
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
-
Low 3.5
Chat room membership disclosed via autocompletion in Nextcloud talk
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a…
-
Medium 5.7
User without download rights can download older version of that file in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions users that should not be able to download a file can still download an older version and use that for uncontrolled distribution. This issue has been addressed in versions 24.0.…