Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
7,388 results · Clear filters · Feed
-
Medium 4.3
WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
-
Medium 4.3
WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerability
Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18.
-
Medium 4.3
WordPress Simple Staff List plugin <= 2.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brett Shumaker Simple Staff List.This issue affects Simple Staff List: from n/a through 2.2.4.
-
Medium 5.3
WordPress Awesome Support plugin <= 6.1.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5.
-
Medium 4.3
WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Arbitrary Plugin Activation vulnerability
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
-
Medium 5.4
WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Plugin Settings Change vulnerability
Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3.
-
Medium 5.4
WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in BulkGate BulkGate SMS Plugin for WooCommerce.This issue affects BulkGate SMS Plugin for WooCommerce: from n/a through 3.0.2.
-
Medium 4.3
WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in TechnoVama Quotes for WooCommerce.This issue affects Quotes for WooCommerce: from n/a through 2.0.1.
-
Medium 4.3
WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6.
-
Medium 5.4
WordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3.
-
Medium 6.5
WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion
The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it po…
-
Medium 4.3
WordPress ACF Photo Gallery Field plugin <= 2.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Navneil Naicker ACF Photo Gallery Field.This issue affects ACF Photo Gallery Field: from n/a through 2.6.
-
Medium 4.3
WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0.
-
Medium 4.3
WordPress Aspose.Words – Import and Export word documents plugin <= 6.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1.
-
Medium 5.3
WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.5.
-
Medium 5.3
WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.
-
Medium 6.5
WordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerability
Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.
-
Medium 5.3
WordPress Preloader for Website plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Preloader for Website.This issue affects Preloader for Website: from n/a through 1.2.2.
-
Medium 4.3
WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8.
-
Medium 5.4
WordPress Tagembed plugin <= 5.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8.
-
Medium 5.4
WordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.5.
-
Medium 4.3
WordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Revolut Revolut Gateway for WooCommerce.This issue affects Revolut Gateway for WooCommerce: from n/a through 4.9.7.
-
Medium 5.3
WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4.
-
Medium 5.3
WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.2.
-
Medium 4.3
WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6.
-
Medium 5.3
WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerability
Missing Authorization vulnerability in Anssi Laitila Contact List contact-list.This issue affects Contact List: from n/a through <= 2.9.87.
-
Medium 5.3
WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability
Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.
-
Medium 4.3
WordPress Slider by Soliloquy – Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Soliloquy Team Slider by Soliloquy.This issue affects Slider by Soliloquy: from n/a through 2.7.2.
-
Medium 5.4
WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14.
-
Medium 5.3
WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10.
-
Medium 5.3
WordPress MC4WP plugin <= 4.9.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in ibericode MC4WP.This issue affects MC4WP: from n/a through 4.9.9.
-
Medium 5.3
WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2.
-
Medium 6.3
WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler.This issue affects CF7 WOW Styler: from n/a through <= 1.6.4.
-
Medium 6.5
WordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1.
-
Medium 4.3
WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0.
-
Medium 5.3
Aimeos HTML client vulnerable to digital products download without proper payment status check
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without…
-
Medium 4.3
WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1.
-
Medium 5.3
WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3.
-
Medium 4.3
WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.25.
-
Medium 5.4
WordPress WP Translate plugin <= 5.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in HahnCreativeGroup WP Translate.This issue affects WP Translate: from n/a through 5.3.0.