Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,328 results · Feed
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information.
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality o…
-
Critical 9.1
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
-
High 7.4
An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery syste…
-
Unscored —
OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) vi…
-
High 8.8
Privilege escalation in XXL-Job
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
-
High 7.5
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vu…
-
Medium 4.3
Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list.
-
High 7.5
AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive informa…
-
Critical 9.8
Improper authentication vulnerability in T&D Corporation and ESPEC MIC CORP. data logger products allows a remote unaut…
-
Medium 4.3
Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions p…
-
Unscored —
Operation restriction bypass vulnerability in MultiReport of Cybozu Garoon 5.15.0 allows a remote authenticated attacke…
-
High 7.7
The GarminOS TVM component in CIQ API version 2.1.0 through 4.1.7 allows applications with a specially crafted head sec…
-
Unscored —
The permission system implemented and enforced by the GarminOS TVM component in CIQ API version 1.0.0 through 4.1.7 can…
-
High 8.8
Authentication bypass vulnerability in Qrio Lock (Q-SL2) firmware version 2.0.9 and earlier allows a network-adjacent a…
-
Medium 6.5
There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured …
-
Medium 5.5CVE-2023-26818 Public exploit
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSER…
-
Medium 6.5
An issue in Zammad v5.4.0 allows attackers to bypass e-mail verification using an arbitrary address and manipulate the …
-
Medium 4.3
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileg…
-
Medium 6.7
In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below syst…
-
High 8.4
In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to regist…
-
Medium 4.7
Privilege escalation to system admin via personal access tokens
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
-
Medium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to …
-
Medium 5.5
An issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to …
-
Medium 6.7
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to t…
-
High 8.8
VMware Aria Operations contains a privilege escalation vulnerability. An authenticated malicious user with ReadOnly pri…
-
Medium 4.3
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checkin…
-
Medium 6.5
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid para…
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
-
Critical 10.0
XWiki Platform privilege escalation (PR)/RCE from account through class sheet
XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-2 and prior to versions 14.10.4 and 15.0-rc-1, it's possible for a user to execute anything with the right of the author of the XWiki.ClassSheet document. This has been patched in XW…
-
Medium 6.5
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to…
-
High 7.1
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…
-
High 7.1
Insecure Permissons vulnerability found in Shop_CMS YerShop all versions allows a remote attacker to escalate privilege…
-
Medium 4.8
OpenSearch issue with fine-grained access control during extremely rare race conditions
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security a…
-
Medium 5.8
On a compromised node, the fluid-csi service account can be used to modify node specs
Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior to version 0.8.6, if a malicious user gains control of a Kubernetes node running fluid csi pod (con…
-
Medium 4.9
Auth bypass in Web Stories for WordPress plugin
The Web Stories for WordPress plugin supports the WordPress built-in functionality of protecting content with a password. The content is then only accessible to website visitors after entering the password. In WordPress, users with the "Author" role can creat…
-
Medium 5.3
Milesight NCR/Camera CWE-200: Exposure of Sensitive Information
Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS B…
-
Medium 6.5
The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.…
-
Medium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4. An …