Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
High 8.4
Improper Access Control in ikus060/rdiffweb
Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
-
High 7.6
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
-
High 8.3
Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
-
Medium 5.3
An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0…
-
Medium 5.3
Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. …
-
High 8.6
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an att…
-
Critical 9.1
The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obt…
-
Medium 5.7
Access policy with access to all tenants and using label selectors has more access
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the…
-
Medium 5.3
A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unau…
-
Medium 6.4
HCL BigFix WebUI is affected by a missing-permission-check vulnerability
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
-
High 8.1
Improper Access Control in openemr/openemr
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.
-
Medium 4.9
vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this i…
-
Medium 6.7
An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Man…
-
Medium 5.4
An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ve…
-
Medium 5.5
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur…
-
Medium 5.5
This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 1…
-
High 8.8
This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, …
-
Medium 5.5
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may …
-
Medium 5.5
Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS …
-
Medium 6.5
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
-
High 7.5
Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to th…
-
High 8.1
A vulnerability has been identified in Mendix Workflow Commons (All versions < V2.4.0), Mendix Workflow Commons V2.1 (A…
-
Medium 5.3
A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All vers…
-
High 8.1
A vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module …
-
High 8.8
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethe…
-
Medium 6.0
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a …
-
Medium 6.4
Invite code reuse via cookie manipulation in sentry
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts whe…
-
Medium 4.0
Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some …
-
Medium 4.0
Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access con…
-
Medium 4.0
Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows…
-
Low 3.9
Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data…
-
Low 2.3
Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to acces…
-
Low 3.3
Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android…
-
Medium 4.6
Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access…
-
Medium 4.0
Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive informat…
-
High 7.5
An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
-
High 8.1
Broken Access Control for some Web-based Management URLs in AirWave Management Platform
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…
-
High 8.1
Broken Access Control for some Web-based Management URLs in AirWave Management Platform
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…
-
High 8.1
Broken Access Control for some Web-based Management URLs in AirWave Management Platform
Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulnerabilities could allow a remote attacker with limited privileges to gain access to sensitive informa…
-
High 7.7
An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.…