Weakness (CWE)
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-285
1,041 results · Clear filters · Feed
-
Medium 5.4
Slideshow, Image Slider by 2J <= 1.3.31 - Authorization Bypass
The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via the wp_ajax_twoj_slideshow_setup AJAX action in versions up to, and including, 1.3.31. This makes i…
-
Medium 6.4
Frontend File Manager <= 18.2 - Privilege Escalation
The Frontend File Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 18.2. This is due to lacking mishandling the use of user IDs that is accessible by the visitor. This makes it possible for unauthenticated o…
-
Medium 6.5
Retrieval of Attachments to Comments lacks Authorization
A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment UUID into other arbi…
-
Medium 4.3
VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_f…
-
Medium 4.3
VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update
The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change…
-
Medium 4.3
Low-privileged User can View Hashed Default Splunk Password
In Splunk Enterprise versions below 9.0.5, 8.2.11. and 8.1.14, and Splunk Cloud Platform versions below 9.0.2303.100, a low-privileged user who holds the ‘user’ role can see the hashed version of the initial user name and password for the Splunk instance by u…
-
Medium 4.3
Role-based Access Control (RBAC) Bypass on '/services/indexing/preview' REST Endpoint Can Overwrite Search Results
On Splunk Enterprise versions below 9.0.5, 8.2.11, and 8.1.14, and in Splunk Cloud Platform versions below 9.0.2303.100, an unauthorized user can access the {{/services/indexing/preview}} REST endpoint to overwrite search results if they know the search ID (S…
-
Medium 6.5
Kyverno resource with a deletionTimestamp may allow policy circumvention
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction…
-
Medium 4.3
In JetBrains TeamCity before 2023.05 improper permission checks allowed users without appropriate permissions to edit B…
-
Medium 6.3
Improper Authorization in openemr/openemr
Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
-
Medium 6.5
Unauthorized user can register an account in specific configurations in Zulip
Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only ones enabled in `AU…
-
Medium 5.5
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Infr…
-
Medium 5.4
Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…
-
Medium 5.4
Cisco DNA Center Software API Vulnerabilities
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root use…
-
Medium 5.4
Cisco DNA Center Software API Vulnerabilities
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root use…
-
Medium 5.4
Cisco DNA Center Software API Vulnerabilities
Multiple vulnerabilities in the API of Cisco DNA Center Software could allow an authenticated, remote attacker to read information from a restricted container, enumerate user information, or execute arbitrary commands in a restricted container as the root use…
-
Medium 4.3
Reading host_configs does not honour contact groups
Improper Authorization in RestAPI in Checkmk GmbH's Checkmk versions <2.1.0p28 and <2.2.0b8 allows remote authenticated users to read arbitrary host_configs.
-
Medium 6.5
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid para…
-
Medium 5.0
Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 softw…
-
Medium 5.0
Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potential…
-
Medium 5.0
Improper authorization in the Intel(R) SCS software all versions may allow an authenticated user to potentially enable …
-
Medium 6.6
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
-
Medium 5.3
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory …
-
Medium 5.3
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing t…
-
Medium 4.0
Improper access control in Samsung Core Service prior to version 2.1.00.36 allows attacker to write arbitrary file in s…
-
Medium 6.3
SourceCodester Service Provider Management System improper authorization
A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorizat…
-
Medium 5.3
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 b…
-
Medium 6.5
Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata
HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or…
-
Medium 4.8
SDM600 API permission check
A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive. This issue affects: All SDM600 versions prior to versi…
-
Medium 4.3
Moodle may allow students to bypass sequential navigation during a quiz attempt
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
-
Medium 4.2
Cilium vulnerable to potential network policy bypass when routing IPv6 traffic
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external tr…
-
Medium 6.3
Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
Medium 4.0
Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows …
-
Medium 4.6
Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploi…
-
Medium 5.3
Cisco Finesse Reverse Proxy VPN-less Access to Finesse Desktop Denial of Service Vulnerability
A vulnerability in the nginx configurations that are provided as part of the VPN-less reverse proxy for Cisco Finesse could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition for new and existing users who are connected th…
-
Medium 6.6
An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 th…
-
Medium 4.3
Improper Authorization in pixelfed/pixelfed
Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
-
Medium 4.3
Permissions Validation Failure in the ‘sendemail’ REST API Endpoint in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘sendemail’ REST API endpoint lets any authenticated user send an email as the Splunk instance. The endpoint is now restricted to the ‘splunk-system-user’ account on the local instance.
-
Medium 4.3
‘createrss’ External Search Command Overwrites Existing RSS Feeds in Splunk Enterprise
In Splunk Enterprise versions below 8.1.13 and 8.2.10, the ‘createrss’ external search command overwrites existing Resource Description Format Site Summary (RSS) feeds without verifying permissions. This feature has been deprecated and disabled by default.
-
Medium 6.2
Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take …