Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 5.8
Document content of files can be obtained through Collabora for files of other users
Nextcloud office/richdocuments is an office suit for the nextcloud server platform. In affected versions the Collabora integration can be tricked to provide access to any file without proper permission validation. As a result any user with access to Collabora…
-
Critical 9.8CVE-2023-0744 Public exploit
Improper Access Control in answerdev/answer
Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
-
High 7.6
An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring a…
-
High 7.4
Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster
A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10;…
-
High 7.2
Rancher: Privilege escalation via promoted roles
A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher…
-
Medium 5.3
Malicious users in Discourse can create spam topics as any user due to improper access control
Discourse is an open source discussion platform. The embeddable comments can be exploited to create new topics as any user but without any clear title or content. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. As a wo…
-
Medium 6.5
Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.
-
Critical 9.8
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Inco…
-
High 7.5
Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining “READONLY” access to log files and certa…
-
Critical 9.8
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotel…
-
Critical 10.0
Hard Coded Credential Crypt Vulnerability
Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are easily discovered and can be used by remote attackers to authenticate via ssh. (The credentials are stored in the firmw…
-
Medium 6.5
Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin
Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials t…
-
Medium 6.5
An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing p…
-
High 7.5
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
-
Medium 4.3
Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userI…
-
High 7.5
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n…
-
Critical 9.8
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import functio…
-
High 7.5
Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticat…
-
Medium 4.3
Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is…
-
High 7.3
Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default pa…
-
Medium 6.3
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). Supported version…
-
High 7.5
An unauthorized user could possibly delete any file on the system.
-
High 7.5
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
-
High 7.5
Component takeover in Oracle Data Provider for .NET
Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle …
-
High 7.3
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (comp…
-
High 7.5
Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite)…
-
High 7.5
Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). Supported ve…
-
High 7.5
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). Suppo…
-
High 7.5
Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(Pock…
-
High 7.5
Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collection…
-
High 7.5
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). Supported versio…
-
High 7.5
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…
-
High 7.5
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported vers…
-
High 8.8
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions …
-
High 8.8
Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). Supported versions …
-
High 8.1
Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (compo…
-
Critical 9.8
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessib…
-
Medium 4.6
Little Apps Little Software Stats Password Reset class.securelogin.php access control
A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads …
-
Medium 5.3
Apache Superset: Dashboard metadata information leak
When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prio…
-
Critical 10.0
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r…