Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,328 results · Feed
-
Unscored —
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could …
-
Unscored —
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could …
-
Medium 6.6
AWS CDK EKS overly permissive trust policies
AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. In the packages `aws-cdk-lib` 2.0.0 until 2.80.0 and `@aws-cdk/aws-eks` 1.57.0 until 1.202…
-
Unscored —CVE-2023-32353 Public exploit
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able…
-
Unscored —CVE-2023-29708 EPSS 14%
An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factor…
-
Critical 9.6
Command Authentication Bypass in Z/IP Gateway
A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.
-
Critical 10.0CVE-2023-35166 EPSS 62%
Privilege escalation (PR) from account through TipsPanel
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 …
-
High 7.5
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability m…
-
Unscored —
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master passw…
-
Medium 5.3
Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may caus…
-
Low 3.8
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault…
-
Medium 4.4
IBM Security Guardium privilege escalation
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
-
Medium 4.3
Adobe Commerce | Incorrect Authorization (CWE-863)
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to …
-
Medium 4.3
[Cloud] Customer suspects IDOR vulnerability
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability…
-
Medium 4.3
Insecure Direct Object Reference (IDOR) in Create Quote Function
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability…
-
High 7.5
Adobe Commerce Incorrect Authorization Security feature bypass
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to leak anoth…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
High 7.8
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrar…
-
Medium 5.4
Discourse Topic Creation Page Allows iFrame Tag without Restrictions
Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, the lack of restrictions on the iFrame tag makes it easy for an attacker to exploit the vulnerabi…
-
High 8.2
Milesight NCR/Camera Authentication Bypass
Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.
-
Medium 6.5
Mazda cars unlocking
A Mazda model (2015-2016) can be unlocked via an unspecified method.
-
Critical 9.8
An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated priv…
-
Medium 5.5
An issue found in Blue Light Filter v.1.5.5 for Android allows unauthorized apps to cause a persistent denial of servic…
-
High 7.8
An issue found in CrossX v.1.15.3 for Android allows a local attacker to cause an escalation of Privileges via the data…
-
Medium 5.5
An issue found in Sleep v.20230303 for Android allows unauthorized apps to cause a persistent denial of service by mani…
-
High 7.8
An issue found in Facemoji Emoji Keyboard v.2.9.1.2 for Android allows unauthorized apps to cause escalation of privile…
-
Medium 5.5
An issue found in FlightAware v.5.8.0 for Android allows unauthorized apps to cause a persistent denial of service by m…
-
Medium 4.3
Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download docu…
-
High 8.8
Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying …
-
Medium 5.3
WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and incl…
-
Low 3.5
URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is…
-
Medium 4.3
Helmholz and MB Connect Line: Account takeover via password reset in multiple products
Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited am…
-
High 7.5
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Comm…
-
High 8.1
Mobatime mobile application - Broken authorisation
Incorrect Authorization vulnerability in Mobatime mobile application AMXGT100 allows a low-privileged user to impersonate anyone else, including administratorsThis issue affects Mobatime mobile application AMXGT100: through 1.3.20.
-
High 7.8
The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain s…
-
Medium 6.8
Mobatime web application - broken authorisation mechanisms
Incorrect Authorization vulnerability in Mobatime web application allows Privilege Escalation, Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobatime web application: through 06.7.22.
-
Critical 9.8
WADE DIGITAL DESIGN CO, LTD. FANTSY - Broken Acesss Control
Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt ser…
-
Medium 6.5
Creation of duplicate SystemPrincipal from less secure contexts
A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This could have lead to bypassing web security checks. This vulnerability affects Firefox < 109.
-
High 8.8
Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensi…
-
Medium 4.3
Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to the…