Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
2,357 results · Clear filters · Feed
-
High 7.8
In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contact…
-
High 8.8
Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it …
-
High 7.5
Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and inclu…
-
High 8.1
org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit…
-
High 7.9
The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be d…
-
High 8.8
WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification
The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level …
-
High 8.1
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API comman…
-
High 7.5
Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers wi…
-
High 7.5
miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to c…
-
High 8.8
Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of th…
-
High 7.7
Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests tha…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.3
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.3
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.8
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 8.2
Non-MFA account takeover via using only SSH public key to login in jumpserver
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered…
-
High 7.1
Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for…
-
High 8.8
Odh-notebook-controller-container: missing authorization allows for file contents disclosure
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
-
High 8.8
Disabled permissions granted by Jenkins Assembla Auth Plugin
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and shou…
-
High 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no…
-
High 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no…
-
High 8.1
Missing Authorization check allows certain operations on CLA Assistant data
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including informati…
-
High 7.5
1Panel arbitrary file write vulnerability exists in the background
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It …
-
High 8.2
PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.
-
High 7.5
PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.
-
High 8.1
Missing Authorization in answerdev/answer
Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.
-
High 8.1
Tolgee Lacks Permission Check for API Key for some endpoints
Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks…
-
High 7.7
Missing Authorization in Jenkins plug-in for ServiceNow DevOps
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version …
-
High 7.5
ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group owner…
-
High 8.8
ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated a…
-
High 7.6
Hazelcast Executor Services don't check client permissions properly
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
-
High 7.1
Plane v0.7.1 - Unauthorized access to files
Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.
-
High 7.3
Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Missing Authorization
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the recieve_post, bmc_disconnect, name_post, and widget_post functions in versions up to, and includin…
-
High 7.3
Sealos billing system permission control defect
Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, res…
-
High 7.5
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the exper…
-
High 8.1
Unauthorized users can delete applications in DataEase
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are ad…
-
High 8.7
WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion
Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <= 0.1.3 versions.