Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 5.7
Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments
Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recomme…
-
High 7.5
The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration da…
-
Medium 5.3
An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see…
-
High 8.8
Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privi…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-…
-
High 8.8
Improper Access Control in calcom/cal.com
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.
-
Medium 5.3
Adobe Commerce Improper Access Control Security feature bypass
Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a us…
-
Medium 4.2
directus vulnerable to Insertion of Sensitive Information into Log File
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…
-
Medium 4.3
Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously configured Octoperf server using attacker-specified credentials.
-
Medium 4.3
Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration
A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
-
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
High 7.8
A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, l…
-
Medium 6.3
SourceCodester E-Commerce System Username access control
A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ecommerce/admin/user/controller.php?action=edit of the component Username Handler. The manipula…
-
Critical 9.1
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of V…
-
Medium 4.4
Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls.…
-
Medium 4.4
Max Secure Anti Virus Plus IoControlCode SDActMon.sys 0x220020 access control
A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls…
-
High 7.8
Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access control
A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation l…
-
Medium 4.4
Lespeed WiseCleaner Wise Force Deleter IoControlCode WiseUnlock64.sys 0x220004 access control
A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper…
-
Medium 4.4
Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control
A vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access contr…
-
Unscored —
ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. Th…
-
Critical 9.1
Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an…
-
High 7.3
SourceCodester Online Food Ordering System POST Request access control
A vulnerability was found in SourceCodester Online Food Ordering System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /fos/admin/ajax.php?action=save_settings of the component POST Request Handler. The manipu…
-
High 7.5
IBM Aspera Faspex improper access controls
IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847.
-
Medium 4.1
Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bl…
-
Medium 4.0
Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in …
-
Medium 5.5
Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applicat…
-
Unscored —
Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2
-
Medium 5.5
Sensitive Information Disclosure in ClearPass OnGuard Ubuntu Agent
A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to retrieve information th…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)
SAP NetWeaver AS Java (Object Analyzing Service) - version 7.50, does not perform necessary authorization checks, allowing an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which wi…
-
Medium 5.3
Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)
Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functionalities that require user identity
-
Medium 4.3
In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned …
-
Unscored —
An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of…
-
Medium 5.7
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions startin…
-
High 8.8
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low pe…
-
High 7.5
A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the adm…
-
High 8.4
Improper Validation of Array Index in Automotive Android OS
Memory corruption in Automotive Android OS due to improper validation of array index.
-
Unscored —
Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlie…
-
Critical 10.0
XWiki Platform users may execute anything with superadmin right through comments and async macro
XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled), but the async macro does not take into account the restricted …
-
Medium 6.5
XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm
XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and access data stored in the database. The problem has been patched in XWiki 13.10.11, 14.4.7, and 14.10. There is no work…
-
Critical 10.0
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workaro…