Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,688 results · Feed
-
High 8.8
Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization
The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of th…
-
Medium 5.3
Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai_ajax
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slugs (including those …
-
Medium 4.3
BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation
The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attacke…
-
Medium 5.4
Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)
S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.
-
High 7.7
Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests tha…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Medium 4.3
File Information Leak via IDOR in file_id in Draft Posts
Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.
-
Unscored —
An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5,…
-
Medium 6.7
In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege wi…
-
Medium 6.7
In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission ch…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Low 3.3
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Medium 5.3
Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure
The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthentic…
-
Medium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Prote…
-
Medium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Prote…
-
Medium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…
-
Medium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…
-
High 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.3
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
High 7.3
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Medium 5.3
IBM UrbanCode Deploy (UCD) improper authentication controls
IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X-Force ID: 263581.
-
High 7.8
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…
-
Medium 5.3
WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to disclose po…
-
Medium 5.1
Missing Authorization in hamza417/inure
Missing Authorization in GitHub repository hamza417/inure prior to build94.
-
Low 3.1
Missing Authorization in GitLab
An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak …
-
High 8.2
Non-MFA account takeover via using only SSH public key to login in jumpserver
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered…
-
Critical 9.8
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could a…
-
High 7.1
Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shell
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for…
-
Unscored —
Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect i…
-
Medium 5.5
Gnome-shell: screenshot tool allows viewing open windows when session is locked
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.
-
Medium 4.3
Jenkins Build Failure Analyzer Plugin missing permission check
A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.
-
Medium 5.8
Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it…
-
High 8.8
Odh-notebook-controller-container: missing authorization allows for file contents disclosure
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
-
Medium 4.3
WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update
The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers…
-
Medium 5.4
Missing Authorization check in SAP Manage Purchase Contracts App
S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation of privileges which h…
-
Unscored —
In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission …
-
Medium 5.0
Missing Authorization in GitLab
An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information about any project's imp…
-
Medium 5.5
An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user…
-
Medium 4.3
Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it …