Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
1,466 results · Clear filters · Feed
-
High 7.7
Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission
Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in …
-
High 7.5
Moodle: idor in feedback non-respondents report allows messaging arbitrary site users
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
-
High 8.8
Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. Non-admin users can manipulate sen…
-
High 8.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have a…
-
High 8.8
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have…
-
High 8.7
Kyverno's PolicyException objects can be created in any namespace by default
Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Admin…
-
High 7.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma…
-
High 7.5
A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, m…
-
High 7.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
High 7.1
Autolab Has Misconfigured Reset Password Permissions
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged …
-
High 8.8
OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePasswor…
-
High 8.8
OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuser…
-
High 7.5
Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request
A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthoriz…
-
High 8.4
Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows at…
-
High 8.4
Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers t…
-
High 8.4
Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to …
-
High 8.4
Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access s…
-
High 8.4
Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to acce…
-
High 8.4
Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access s…
-
High 8.0
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. Users …
-
High 8.0
An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. The SI…
-
High 7.8
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to…
-
High 7.8
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to…
-
High 7.1
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: …
-
High 7.1
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: …
-
High 8.1
Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported ver…
-
High 8.1
Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payr…
-
High 8.1
Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that …
-
High 8.1
Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported vers…
-
High 8.1
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (compone…
-
High 8.1
Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integra…
-
High 8.1
Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). Supported version…
-
High 8.1
Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). Supported versions …
-
High 8.1
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal)…
-
High 8.1
Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). S…
-
High 8.1
Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Support…
-
High 8.1
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported…
-
High 8.1
Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported vers…
-
High 8.1
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported ve…
-
High 8.1
Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported ve…