Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
301 results · Clear filters · Feed
-
Low 3.7
The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the…
-
Low 3.1
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query handler of the affect…
-
Low 3.8
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not…
-
Low 2.3
Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner&…
-
Low 3.5
Flarum is missing authorization in discussion replies
Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lo…
-
Low 3.3
In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive set…
-
Low 3.3
In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to …
-
Low 3.3
In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a …
-
Low 3.3
In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing …
-
Low 2.4
In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in…
-
Low 3.3
In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missi…
-
Low 2.3
In sOpAllowSystemRestrictionBypass of AppOpsManager.java, there is a possible leak of location information due to a mis…
-
Low 3.3
Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list.
-
Low 3.3
In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the b…
-
Low 2.7CVE-2022-2841 Public exploit
CrowdStrike Falcon Uninstallation authorization
A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstallation Handler. The manipulation leads to missing authorization. It is possible…
-
Low 3.4
Renderers can obtain access to random bluetooth device without permission in Electron
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device v…
-
Low —
Generation of fake documents via public GET-call
### Impact Generation of fake documents via public GET-call ### Patches We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/…
-
Low —
Key Caching behavior in the DynamoDB Encryption Client.
### Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider…
-
Low —
Key Caching behavior in the DynamoDB Encryption Client.
### Impact This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified. When key usage permissions were changed at the key provider…
-
Low 3.7
Moodle Email media URL tokens were not checking for user status
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the f…
-
Low —
Moodle doesn't properly check role
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.