Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
1,466 results · Clear filters · Feed
-
High 7.3CVE-2023-34035 Public exploit
Spring Security's authorization rules can be misconfigured when using multiple servlets
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s Dispatche…
-
High 7.2
Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This ma…
-
High 8.8
TAPHOME Improper Authentication in Core Platform
A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability.
-
High 7.8
In showNextSecurityScreenOrFinish of KeyguardSecurityContainerController.java, there is a possible way to access the lo…
-
High 8.2
Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brok…
-
High 8.2
Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. Any authenticated user can retrieve a source's configuration or a sink's configuration without auth…
-
High 8.1
GLPI vulnerable to unauthorized access to Dashboard data
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modif…
-
High 7.5
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability m…
-
High 7.5
Adobe Commerce Incorrect Authorization Security feature bypass
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak anoth…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 8.2
Milesight NCR/Camera Authentication Bypass
Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.
-
High 7.8
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the data…
-
High 7.8
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privile…
-
High 8.8
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying …
-
High 7.5
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comm…
-
High 8.1
Mobatime mobile application - Broken authorisation
Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.
-
High 7.8
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain s…
-
High 8.8
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information.
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality o…
-
High 7.4
An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery syste…
-
High 8.8
Privilege escalation in XXL-Job
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
-
High 7.5
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vu…
-
High 7.5
AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive informa…
-
High 7.7
The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head sec…
-
High 8.8
Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent a…
-
High 8.4
In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to regist…
-
High 8.8
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly pri…
-
High 7.1
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…
-
High 7.1
Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privilege…
-
High 8.1CVE-2023-31435 Public exploit
Multiple components (such as Onlinetemplate-Verwaltung, Liste aller Teilbereiche, Umfragen anzeigen, and questionnaire …
-
High 7.8
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppU…
-
High 7.8
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppD…
-
High 7.8
An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppU…
-
High 7.8
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 win…
-
High 8.8
Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server …
-
High 7.5
Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0,…
-
High 7.8
VMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read/write access to the host…
-
High 8.4
An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behav…