Weakness (CWE)
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-285
1,892 results · Feed
-
Low 3.5
It was found Ceph versions before 13.2.4 that authenticated ceph users with read only permissions could steal dm-crypt …
-
Medium 6.8
go.etcd.io/etcd Authentication Bypass
etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) wh…
-
Medium 6.5
Improper Authorization in Jenkins
A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances us…
-
High 8.1
Cisco Adaptive Security Appliance Software Privilege Escalation Vulnerability
A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, but unprivileged (levels 0 and 1), remote attacker to perform privileged actions by using the web management interface. The vulner…
-
Medium 6.1
Improper Authentication in Keycloak
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
-
Unscored —
VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User …
-
Unscored —
Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-sid…
-
Unscored —
Cisco Enterprise NFV Infrastructure Software Information Disclosure Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation check…
-
Unscored —
Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability
A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an auth…
-
Unscored —
In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on n…
-
High 8.8
An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attac…
-
Medium 4.3
foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize op…
-
Medium 4.3
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a …
-
High 8.8
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs pass…
-
Medium 5.3
Improper Authorization in aedes
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.
-
Unscored —
A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated,…
-
Medium 4.4
openbuildservice allowed deleting packages via project links
openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
-
Medium 6.0
delete package via link exploit in open buildservice
Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
-
Medium 4.9
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create…
-
High 8.7
Insecure cookie sharing in Hawtio
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sh…
-
Medium 5.3CVE-2018-10906 Public exploit
In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is ac…
-
Unscored —
A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authe…
-
Medium 4.7
A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_a…
-
Unscored —
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can …
-
Medium 6.5
Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote …
-
Medium 4.8
setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to …
-
Unscored —
Beckhoff TwinCAT supports communication over ADS. ADS is a protocol for industrial automation in protected environments…
-
High 8.1
Moodle Improper Authentication
A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component r…
-
Unscored —
Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component…
-
Medium 6.5
Improper authorization in Jenkins Job and Node Ownership Plugin
An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java that allow an attacker with Job/Configure or Computer/Configure permi…
-
Medium 4.4
open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions
In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource c…
-
Unscored —CVE-2017-11398 Public exploit
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 a…
-
Unscored —
An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products runni…
-
High 7.2
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource cou…
-
Unscored —
Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization
-
Unscored —
An Improper Authorization issue was discovered in Sierra Wireless AirLink Raven XE, all versions prior to 4.0.14, and A…
-
Unscored —
Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zul…
-
Unscored —
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before …
-
Unscored —
Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical …