Weakness (CWE)
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-285
1,041 results · Clear filters · Feed
-
Medium 5.4
Zulip Server insufficient authorization for changing bot roles
Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is f…
-
Medium 6.2
Improper authorization vulnerability in Knoxguard prior to SMR Jul-2022 Release 1 allows local attacker to disable keyg…
-
Medium 4.0
Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FI…
-
Medium 4.6
Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authe…
-
Medium 6.2
Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass u…
-
Medium 4.0
Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera func…
-
Medium 4.3
Improper access control for pencil annotations in BigBlueButton
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the serv…
-
Medium 4.3
Grace period for lock settings in public/private chats in BigBlueButton
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker nee…
-
Medium 4.3
Improper access control for breakout rooms in BigBlue Button
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely …
-
Medium 4.3
Cortex XSOAR: Incorrect Authorization Vulnerability When Generating Reports
An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including in…
-
Medium 5.4
Write access to the Catalog for any user when restricted-admin role is enabled
A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restricted-admin role is enabled. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4.
-
Medium 5.9
Improper access control vulnerability in Galaxy Store prior to version 4.5.36.4 allows attacker to install applications…
-
Medium 6.5
Improper Authorization in phpipam/phpipam
Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
-
Medium 4.3
Improper Authorization in janeczku/calibre-web
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
-
Medium 5.4
Improper Authorization in webmin/webmin
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
-
Medium 4.0
Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected acti…
-
Medium 5.3
Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
-
Medium 4.0
Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applic…
-
Medium 4.0
Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PR…
-
Medium 4.0
Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to ge…
-
Medium 6.1
Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to tempora…
-
Medium 6.5
Authorization Bypass in Space Invite in HumHub
HumHub is an open-source social network kit written in PHP. Prior to HumHub version 1.10.3 or 1.9.3, it could be possible for registered users to become unauthorized members of private Spaces. Versions 1.10.3 and 1.9.3 contain a patch for this issue.
-
Medium 4.0
Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get…
-
Medium 6.0
Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. Any local malicious user wit…
-
Medium 4.3
TVN-202110009
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.
-
Medium 5.7
Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC applic…
-
Medium 6.5
Publify - Improper Authorization Leads to Guest Signup Restriction Bypass
In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
-
Medium 4.3
Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters.
-
Medium 4.3
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-3
The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attackers can access the content of other users’ message boards by crafting URL parameters.
-
Medium 5.4
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
-
Medium 5.3
Tad Uploader - Improper Authorization
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
-
Medium 5.3
Tad Web - Improper Authorization
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
-
Medium 5.3
Tad Honor - Improper Authorization
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
-
Medium 4.0
An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Medium 4.0
An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Medium 5.0
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Acces…
-
Medium 6.5
Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclo…
-
Medium 6.5
Magento Commerce improper Authorization via the 'Create Customer' endpoint
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer dat…
-
Medium 6.5
Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an un…
-
Medium 6.1
An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthoriz…