Weakness (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it (1 mitigation)
-
Architecture and Design
Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
Source: MITRE CWE-288
175 results · Clear filters · Feed
-
Medium 6.4
PingID Integration for Windows Login MFA Bypass
Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user cred…
-
Medium 6.5
ICSMA-22-095-01 LifePoint Informatics Patient Portal
Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.
-
Medium 5.3
Authentication Bypass Using an Alternate Path or Channel in CreateWiki
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` bran…
-
Medium 5.3
This vulnerability allows remote attackers to bypass authentication on affected installations of BMC Track-It! 20.21.01…
-
Medium 5.9
Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass v…
-
Medium 6.5
Authentication bypass in SilverStripe GraphQL
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-L…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NET…
-
Medium 5.1
Internal NCryptDecrypt method could be used externally from WindowsHello library.
The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing authentication. If the library is used to encrypt text and w…
-
Medium 6.3
Junos OS: EX and QFX Series: Console port authentication bypass vulnerability
On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device…
-
Medium 5.3
Microsoft Windows RDP can bypass the Windows lock screen
A vulnerability in Microsoft Windows 10 1803 and Windows Server 2019 and later systems can allow authenticated RDP-connected clients to gain access to user sessions without needing to interact with the Windows lock screen. Should a network anomaly trigger a t…
-
Medium 4.2
Access Control Bypass
An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This…
-
Medium 6.6
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could …
-
Medium —
Moodle Authentication Bypass in Question-Bank
The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a save_question action.
-
Medium —
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.