Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
2,089 results · Clear filters · Feed
-
Medium 5.3
Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may caus…
-
Medium 4.4
IBM Security Guardium privilege escalation
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
-
Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to …
-
Medium 4.3
[Cloud] Customer suspects IDOR vulnerability
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability…
-
Medium 4.3
Insecure Direct Object Reference (IDOR) in Create Quote Function
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability…
-
Medium 5.4
Discourse Topic Creation Page Allows iFrame Tag without Restrictions
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerabi…
-
Medium 6.5
Mazda cars unlocking
A Mazda model (2015-2016) can be unlocked via an unspecified method.
-
Medium 5.5
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of servic…
-
Medium 5.5
An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by mani…
-
Medium 5.5
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by m…
-
Medium 4.3
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download docu…
-
Medium 5.3
WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and incl…
-
Medium 4.3
Helmholz and MB Connect Line: Account takeover via password reset in multiple products
Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited am…
-
Medium 6.8
Mobatime web application - broken authorisation mechanisms
Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
Medium 4.3
Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to the…
-
Medium 4.3
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
-
Medium 4.3
Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions p…
-
Medium 6.5
There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured …
-
Medium 5.5CVE-2023-26818 Public exploit
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSER…
-
Medium 6.5
An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the …
-
Medium 4.3
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileg…
-
Medium 6.7
In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below syst…
-
Medium 4.7
Privilege escalation to system admin via personal access tokens
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
-
Medium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to …
-
Medium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to …
-
Medium 6.7
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to t…
-
Medium 4.3
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checkin…
-
Medium 6.5
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid para…
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
Medium 4.8
OpenSearch issue with fine-grained access control during extremely rare race conditions
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security a…
-
Medium 5.8
On a compromised node, the fluid-csi service account can be used to modify node specs
Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior to version 0.8.6, if a malicious user gains control of a Kubernetes node running fluid csi pod (con…
-
Medium 4.9
Auth bypass in Web Stories for WordPress plugin
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can creat…
-
Medium 5.3
Milesight NCR/Camera CWE-200: Exposure of Sensitive Information
Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS B…
-
Medium 6.5
The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An …
-
Medium 5.4
BIG-IQ iControl REST Vulnerability
An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 6.5
Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of da…