Skip to content
OpenAdvisories

Weakness (CWE)

CWE-302: Authentication Bypass by Assumed-Immutable Data

Base Incomplete

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

How to prevent it (1 mitigation)

  1. Architecture and Design, Operation, Implementation

    Implement proper protection for immutable data (e.g. environment variable, hidden form fields, etc.)

Source: MITRE CWE-302

All Critical High Medium Low Exploited only Public exploit

48 results · Feed

  • Medium 5.9
    CVE-2022-23501

    TYPO3 vulnerable to Improper Authentication in Frontend Login

    TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage fol…

    TYPO3 typo3 typo3/cms typo3/cms-core Web / CMS Packagist
  • Medium 5.2
    CVE-2022-40703

    CWE-302 Authentication Bypass by Assumed-Immutable Data in AliveCor Kardia App version 5.17.1-754993421 and prior on An…

    AliveCor Kardia App
  • Medium 6.9
    CVE-2022-2503

    Linux Kernel LoadPin bypass via dm-verity table reload

    Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …

    Linux kernel Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2022-22729

    CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets…

    Yokogawa Electric CENTUM VP Exaopc CENTUM CS 3000 ICS / OT
  • Medium 5.4
    CVE-2021-1561

    Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability

    A vulnerability in the spam quarantine feature of Cisco Secure Email and Web Manager, formerly Cisco Security Management Appliance (SMA), could allow an authenticated, remote attacker to gain unauthorized access and modify the spam quarantine settings of anot…

    Cisco Cisco Content Security Management Appliance (SMA) Network devices
  • Medium 4.3
    CVE-2021-1399

    Cisco Unified Communications Manager Self Care Portal Authorization Bypass Vulnerability

    A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to modify data on an affected syste…

    Cisco Cisco Unified Communications Manager Network devices
  • Unscored —
    CVE-2020-15074

    OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of re…

  • Unscored —
    CVE-2016-9482

    PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass

    Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel

    PHP FormMail Generator