Weakness (CWE)
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-285
1,892 results · Feed
-
Medium 5.4
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2
The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote attackers can access and edit other users’ tutorial schedule by crafting URL parameters.
-
High 8.8
ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1
The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote attackers can access and edit other users’ credential and personal information by crafting URL parameters.
-
High 8.8
Bypassing policy restrictions on regular users
Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true fo…
-
Unscored —
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could ch…
-
High 8.8
AccessPress Themes - Authenticated Malicious File Upload
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in …
-
Medium 5.3
Tad Uploader - Improper Authorization
Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder names in the book list without logging in.
-
High 7.5
Tad TadTools - Improper Authorization
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
-
Critical 9.1
Tad Book3 - Improper Authorization
Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.
-
Medium 5.3
Tad Web - Improper Authorization
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
-
Medium 5.3
Tad Honor - Improper Authorization
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
-
High 7.1
Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows at…
-
High 7.4
Account takeover when having only access to a user's short lived token in wire-server
Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger email address change of a user with only the short-lived session token in the `Authorization` header. As the short-lived to…
-
High 7.4
Account takeover when having only access to a user's short lived token
Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally …
-
Medium 4.0
An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Medium 4.0
An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows att…
-
Low 2.6
Cortex XSOAR: Improper Authorization of Incident Investigations Vulnerability
An improper authorization vulnerability in the Palo Alto Networks Cortex XSOAR server enables an authenticated network-based attacker with investigation read permissions to download files from incident investigations of which they are aware but are not a part…
-
Medium 5.0
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Acces…
-
Critical 9.1
Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code executio…
-
Medium 6.5
Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclo…
-
High 8.2
CEM Systems AC2000
A vulnerability in versions 10.1 through 10.5 of Johnson Controls CEM Systems AC2000 allows a remote attacker to access to the system without adequate authorization. This issue affects: Johnson Controls CEM Systems AC2000 10.1; 10.2; 10.3; 10.4; 10.5.
-
Unscored —
In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to mak…
-
Low 3.7
Adobe Experience Manager Improper Authorization at /content/usergenerated
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by an Improper Authorization vulnerability allowing users to create nodes under a location. An unauthenticated attacker could leverage this vulnerability to c…
-
Low —
Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
### Impact This is pro-active fix. No know exploits exist. Impacted: * You're running Kubernetes >= v1.19 * You're running Argo Server * It is configured to with `--auth-mode=client` * Is not configured with `--auth-mode=server` * You are not running Argo Ser…
-
Critical 9.4
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view devic…
-
Critical 10.0
Improper Authorization and Origin Validation Error in OneFuzz
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable On…
-
High 8.8
Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead …
-
Critical 9.8
Obsidian does not require user confirmation for non-http/https URLs.
Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.
-
High 7.3
Learningdigital.com, Inc. Orca HCM - Broken Authentication
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, th…
-
High 8.8
Application specific tokens can change their own scope
Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be c…
-
High 8.8
Cisco Business Process Automation Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement…
-
High 8.8
Cisco Business Process Automation Privilege Escalation Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Business Process Automation (BPA) could allow an authenticated, remote attacker to elevate privileges to Administrator. These vulnerabilities are due to improper authorization enforcement…
-
Unscored —
Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows unt…
-
Critical 9.1
QSAN Storage Manager - Improper Authorization
Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
-
Medium 6.5
Magento Commerce improper Authorization via the 'Create Customer' endpoint
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer dat…
-
Critical 9.8
Cortex XSOAR: Unauthorized Usage of the REST API
An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 bu…
-
Critical 9.9
Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an…
-
Medium 6.5
Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an un…
-
Unscored —
Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privi…
-
Unscored —
Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage.
-
Unscored —
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files i…