Weakness (CWE)
CWE-306: Missing Authentication for Critical Functionality
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
-
Architecture and Design
Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
Source: MITRE CWE-306
1,266 results · Clear filters · Feed
-
High 7.5
In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the…
-
High 7.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when ac…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.5
BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server. This vulnerability allows a…
-
High 7.5
When Xiaomi router firmware is updated in 2020, there is an unauthenticated API that can reveal WIFI password vulnerabi…
-
High 7.5
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Auth…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…
-
High 8.8
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
High 7.5
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…
KEV Aug 22, 2023 -
High 8.2
An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mecha…
-
High 7.5
Apollo has potential access control security issue in eureka
Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-i…
-
High 7.5
Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without kn…
-
High 8.1
Missing Authentication for Critical Function in kareadita/kavita
Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.
-
High 7.3
SourceCodester Online Pizza Ordering System POST Parameter ajax.php delete_category missing authentication
A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing…
-
High 7.5
TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmwar…
-
High 7.5
CVE-2023-22803
LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily.
-
High 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affec…
-
High 7.5
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this …
-
High 7.5
The bundle management module lacks authentication and control mechanisms in some APIs. Successful exploitation of this …
-
High 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affec…
-
High 8.6
Broken Access Control in 3rd party TYPO3 extension "femanager"
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.
-
High 8.6
Broken Access Control in 3rd party TYPO3 extension "femanager"
An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users.
-
High 8.6
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and …
-
High 7.8
The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Mana…
-
High 7.5
ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. An authentication bypass in the docum…
-
High 7.5
Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Repo…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported v…
-
High 7.5
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV May 1, 2023 -
High 7.5CVE-2023-21837 Public exploit
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
-
High 7.5CVE-2022-46463 Public exploit
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories wit…
-
High 7.5
Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtai…
-
High 7.5
An issue in the component tpi_systool_handle(0) (/goform/SysToolReboot) of Tenda W6-S v1.0.0.4(510) allows unauthentica…
-
High 7.5CVE-2022-45504 EPSS 18%
An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthen…
-
High 7.5
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The u…
-
High 8.8
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of servic…
-
High 7.5
The memory management module has the logic bypass vulnerability. Successful exploitation of this vulnerability may affe…
-
High 7.3
Password recovery vulnerability in SICK SIM1012 Partnumber 1098146 with firmware version <2.2.0 allows an unprivileged …
-
High 7.3
Password recovery vulnerability in SICK SIM2x00 (ARM) Partnumber 1092673 and 1081902 with firmware version < 1.2.0 allo…
-
High 7.5
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprun…