Weakness (CWE)
CWE-284: Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
How to prevent it (2 mitigations)
-
Architecture and Design, Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-284
8,243 results · Feed
-
Medium 6.4
Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
-
Medium 4.0
Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows atta…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Unscored —
Improper access control in mum_container_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read…
-
Medium 4.0
Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.4
Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive info…
-
High 7.3
Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers…
-
Unscored —
Improper access control in knox_vpn_policy service prior to SMR Oct-2022 Release 1 allows allows unauthorized read of c…
-
Medium 4.0
Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bi…
-
Medium 4.0
Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitiv…
-
Medium 5.1
Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to co…
-
Medium 4.0
Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to…
-
Medium 4.0
Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android …
-
Medium 5.1
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized…
-
Medium 4.0
Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attack…
-
Low 3.3
Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attacke…
-
Medium 4.0
Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows att…
-
Medium 4.7
Cisco Access Points VLAN Bypass from Native VLAN Vulnerability
A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adjacent attacker to inject packets from the native VLAN to clients within nonnative VLANs on an affected device. This vulnerability is due to …
-
Medium 6.6
AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This i…
-
Medium 4.3
IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they sho…
-
Medium 5.3
An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An …
-
Medium 5.5
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur …
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to byp…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthori…
-
High 7.8
Measuresoft ScadaPro Server Improper Access Control
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
-
Medium 4.3
An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUse…
-
High —
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
### Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. ### Patches lakeFS v0.82.0 and later ### Workarounds Drop specific request to the lakeFS listen port. Any request wi…
-
Medium 5.3
Access control vulnerability in Evoh NFT EvohClaimable contract with sha256 hash code fa2084d5abca91a62ed1d2f1cad3ec318…
-
Medium 5.3
Jenkins WildFly Deployer Plugin vulnerable to path traversal
Jenkins WildFly Deployer Plugin 1.0.2 and earlier implements functionality that allows agent processes to read arbitrary files on the Jenkins controller file system.
-
Medium 6.5
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.5. An app may be able t…
-
Medium 5.5CVE-2022-32883 Public exploit
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS…
-
Low 2.4
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16, iOS 15.7 and iPadOS 15.7. A pers…
-
Critical 9.3
LDAP Connector: When startTLS is used then LDAP connector ignores the wrong password
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server …
-
High 7.1
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set acc…
-
High 8.8
Neo Information Sys. NIS-HAP11AC remote access and manipulation vulnerability
This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device.
-
High 8.2
Zoom On-Premise Deployments: Improper Access Control
Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting…
-
High 8.8
Improper Control of Dynamically-Managed Code Resources in budibase/budibase
Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.
-
Unscored —
Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and ear…
-
Medium 5.7
Contec Health CMS8000
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, t…