Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.5
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to …
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2,…
-
Medium 5.5
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.…
-
Medium 5.7
Nextcloud download permissions can be changed by resharer
Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. …
-
Medium 5.3
Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control
A vulnerability was found in Twister Antivirus 8.17. It has been declared as critical. This vulnerability affects the function 0x801120E4 in the library filmfd.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. The…
-
Medium 6.5
SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control
A vulnerability classified as critical has been found in SourceCodester Alphaware Simple E-Commerce System 1.0. This affects an unknown part of the file /alphaware/summary.php of the component Payment Handler. The manipulation of the argument amount leads to …
-
High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
-
High 7.3CVE-2023-0963 Public exploit
SourceCodester Music Gallery Site POST Request Users.php access control
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The …
-
Critical 9.8
An access control issue in Axcora POS #0~gitf77ec09 allows unauthenticated attackers to execute arbitrary commands via …
-
Critical 9.8
A security misconfiguration vulnerability exists in the Zyxel LTE3316-M604 firmware version V2.00(ABMP.6)C0 due to a fa…
-
Medium 6.3CVE-2023-0916 Public exploit
SourceCodester Auto Dealer Management System Users.php access control
A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attac…
-
High 8.2
Moodle: possible to set the preferred "start page" of other users
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise res…
-
Medium 5.3
Adobe Connect Improper Access Control Security feature bypass
Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature…
-
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
Medium 5.5
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
A malicious user can cause log files to be written to a directory that they do not have permission to write to.
-
High 7.8
Privilege Escalation on the system running a vulnerable version of Citrix Workspace app for Windows
Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app.
-
Critical 9.8
CVE-2023-22807
LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol.
-
Medium 6.5
CVE-2023-22805
LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device.
-
High 7.8
In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypa…
-
High 8.8
An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main…
-
Critical 9.8
In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled roo…
-
High 8.8
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
-
High 8.7
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
-
High 8.8
TimescaleDB has incorrect access control
TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the tele…
-
Medium 5.9
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.34), Mendix Application…
-
Low 3.7
Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 25.0.1 24.0.8, and 23.0.12 missing rate limiting on password reset functionality. This could re…
-
Low 2.3
Nextcloud Server previews are accessible without a watermark
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform, and Nextcloud Office is a document collaboration app for the same platform. Nextcloud Server 24.0.x prior to 24.0.8 and 25.0.x prior to 25.0.1, Nextcloud Enterpri…
-
High 8.7
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 6.8
Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin c…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin u…
-
Medium 4.9
Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A malicious admin user can disabl…
-
High 8.4
Improper access control in Qualcomm IPC
Memory corruption due to improper access control in Qualcomm IPC.
-
Medium 5.3
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Regist…
-
Medium 5.4
Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without …
-
Low 2.1
Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected b…
-
Medium 5.5
Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(1…
-
Medium 4.0
Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access inf…
-
Medium 4.0
Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.…
-
Medium 5.3
Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a sp…