Weakness (CWE)

CWE-284: Improper Access Control

Pillar Incomplete Mapping discouraged

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it (2 mitigations)

Architecture and Design, Operation

Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-284

All Critical High Medium Low Exploited only Public exploit

8,243 results · Feed

Unscored —

CVE-2022-25755

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 …

Siemens SCALANCE X302-7 EEC (2x 230V, coated) SCALANCE X302-7 EEC (2x 24V, coated) SCALANCE X304-2FE ICS / OT

Apr 12, 2022
Unscored —

CVE-2022-25650

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.27), Mendix Application…

Siemens Mendix Applications using Mendix 9 Mendix Applications using Mendix 8 Mendix Applications using Mendix 7 ICS / OT

Apr 12, 2022
Unscored —

CVE-2021-42029

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 …

Siemens SIMATIC STEP 7 (TIA Portal) V15 SIMATIC STEP 7 (TIA Portal) V16 SIMATIC STEP 7 (TIA Portal) V17 ICS / OT

Apr 12, 2022
Medium 4.4

CVE-2022-28778

Improper access control vulnerability in Samsung Security Supporter prior to version 1.2.40.0 allows attacker to set th…

Samsung Mobile Samsung Security Supporter

Apr 11, 2022
Medium 4.3

CVE-2022-28777

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute ca…

Samsung Mobile Samsung Members

Apr 11, 2022
Medium 5.1

CVE-2022-28775

Improper access control vulnerability in Samsung Flow prior to version 4.8.06.5 allows attacker to write the file witho…

Samsung Mobile Samsung Flow

Apr 11, 2022
Medium 6.8

CVE-2022-28542

Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access pri…

Samsung Mobile Galaxy Store

Apr 11, 2022
High 7.7

CVE-2022-27838

Improper access control vulnerability in FactoryCamera prior to version 2.1.96 allows attacker to access the file with …

Samsung Mobile FactoryCamera

Apr 11, 2022
High 8.4

CVE-2022-27836

Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Ap…

Samsung Mobile Samsung Mobile Devices

Apr 11, 2022
Medium 6.6

CVE-2022-27822

Information exposure vulnerability in ril property setting prior to SMR April-2022 Release 1 allows access to EF_RUIMID…

Samsung Mobile Samsung Mobile Devices

Apr 11, 2022
Medium 5.7

CVE-2022-26091

Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can…

Samsung Mobile Samsung Mobile Devices

Apr 11, 2022
Low 2.0

CVE-2022-25831

Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access s…

Samsung Mobile Samsung Mobile Devices

Apr 11, 2022
High 7.8

CVE-2022-20762

Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Privilege Escalation Vulnerability

A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerabilit…

Cisco Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Network devices

Apr 6, 2022
Medium 4.3

CVE-2022-0405

Improper Access Control in janeczku/calibre-web

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.

janeczku janeczku/calibre-web

Apr 3, 2022
High 7.5

CVE-2021-28504

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol fi ...

On Arista Strata family products which have “TCAM profile” feature enabled when Port IPv4 access-list has a rule which matches on “vxlan” as protocol then that rule and subsequent rules ( rules declared after it in ACL ) do not match on IP protocol field as e…

Arista Networks EOS Network devices

Apr 1, 2022
High 8.8

CVE-2021-36776

Steve API proxy impersonation

A Improper Access Control vulnerability in SUSE Rancher allows remote attackers impersonate arbitrary users. This issue affects: SUSE Rancher Rancher versions prior to 2.5.10.

SUSE Rancher github.com/rancher/rancher Go

Apr 1, 2022
High 8.8

CVE-2021-36775

Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings

a Improper Access Control vulnerability in SUSE Rancher allows users to keep privileges that should have been revoked. This issue affects: SUSE Rancher Rancher versions prior to 2.4.18; Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3.

SUSE Rancher github.com/rancher/rancher Go

Apr 1, 2022
Medium 6.8

CVE-2022-24731

Path traversal allows leaking out-of-bound files from Argo CD repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal vulnerability, allowing a malicious user with read/write access to lea…

argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Mar 23, 2022
High 7.7

CVE-2022-24730

Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.2.6, and 2.3.0 is vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a maliciou…

argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Mar 23, 2022
Medium 4.0

CVE-2022-25481 Scanner template

Exposure of Resource to Wrong Sphere in ThinkPHP Framework

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an inte…

topthink/framework Packagist

Mar 20, 2022
Unscored —

CVE-2022-23730

The public API error causes for the attacker to be able to bypass API access control.

Mar 11, 2022
High 7.8

CVE-2021-42855

Local privilege escalation due to misconfigured write permission on .debug_command.config file

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appIntern…

Aternity SteelCentral AppInternals Dynamic Sampling Agent

Mar 9, 2022
Medium 4.0

CVE-2022-25824

Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applicat…

Samsung Mobile BixbyTouch

Mar 8, 2022
Medium 4.4

CVE-2022-24930

An Improper access control vulnerability in StRetailModeReceiver in Wear OS 3.0 prior to Firmware update MAR-2022 Relea…

Samsung Mobile Samsung Wearable Devices

Mar 8, 2022
Unscored —

CVE-2022-26317

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the…

Siemens Mendix Applications using Mendix 7 ICS / OT

Mar 8, 2022
Unscored —

CVE-2022-26313

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In cer…

Siemens Mendix Forgot Password Appstore module ICS / OT

Mar 8, 2022
Medium 6.8

CVE-2022-24309

A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V…

Siemens Mendix Runtime V8 Mendix Runtime V9 Mendix Runtime V7 ICS / OT

Mar 8, 2022
Unscored —

CVE-2021-41543

A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM modul…

Siemens Climatix POL909 (AWM module) Climatix POL909 (AWB module) ICS / OT

Mar 8, 2022
Low 2.7

CVE-2021-46270

JFrog Artifactory before 7.31.10, is vulnerable to Broken Access Control where a project admin user is able to list all…

jfrog JFrog Artifactory

Mar 2, 2022
Medium 4.3

CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to d…

jfrog JFrog Artifactory

Mar 2, 2022
High 8.3

CVE-2022-0824 Public exploit Scanner template EPSS 97%

Improper Access Control to Remote Code Execution in webmin/webmin

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

Webmin webmin/webmin

Mar 2, 2022
Unscored —

CVE-2021-24688

Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arb…

Web / CMS

Feb 28, 2022
Medium 4.1

CVE-2021-3967

Improper Access Control in zulip/zulip

Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

zulip zulip/zulip

Feb 26, 2022
High 7.2

CVE-2022-21706

Multi-use invitations can grant access to other organizations in Zulip

Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerab…

zulip zulip

Feb 25, 2022
Medium 5.3

CVE-2020-14504

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, un…

Rockwell Automation 1734-AENTR ICS / OT

Feb 24, 2022
Unscored —

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or aut…

1Byte iSpyoo TheSpyApp SecondClone

Feb 24, 2022
Medium 5.4

CVE-2022-0731

Improper Access Control (IDOR) in dolibarr/dolibarr

Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

Dolibarr dolibarr/dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist

Feb 23, 2022
Medium 5.4

CVE-2022-0727

Improper Access Control in chocobozzz/peertube

Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.

Chocobozzz chocobozzz/peertube

Feb 23, 2022
Medium 4.3

CVE-2022-23981

WordPress Perfect Brands for WooCommerce plugin <= 2.0.4 - Set Featured Brand vulnerability

The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).

quadlayers Perfect Brands for WooCommerce (WordPress plugin) Web / CMS

Feb 18, 2022
High 7.1

CVE-2022-0580

Incorrect Authorization in librenms/librenms

Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.

librenms librenms/librenms librenms/librenms Packagist

Feb 14, 2022