Weakness (CWE)
CWE-863: Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-863
4,328 results · Feed
-
High 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions witho…
-
Medium 6.5
Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versi…
-
Medium 6.5
Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 …
-
Critical 9.8
Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker…
-
Low 2.7
IBM Security Key Lifecycle Manager denial of service
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629.
-
Medium 5.4
IBM Security Key Lifecycle Manager improper authorization
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to perform actions that they should not have access to due to improper authorization. IBM X-Force ID: 247630.
-
Critical 9.1
Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
Galaxy is an open-source platform for data analysis. All supported versions of Galaxy are affected prior to 22.01, 22.05, and 23.0 are affected by an insufficient permission check. Unsupported versions are likely affected as far back as the functionality of V…
-
Medium 4.2
Cilium vulnerable to potential network policy bypass when routing IPv6 traffic
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external tr…
-
High 8.2
On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify…
-
Medium 4.4
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Mar 14, 2023 -
Critical 9.6CVE-2022-39214 EPSS 26%
Authenticated users of Combodo iTop can take over any account
Combodo iTop is an open source, web-based IT service management platform. Prior to versions 2.7.8 and 3.0.2-1, a user who can log in on iTop is able to take over any account just by knowing the account's username. This issue is fixed in versions 2.7.8 and 3.0…
-
Medium 6.3
Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface
A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability all…
-
Medium 4.4
Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation
HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1…
-
High 8.1
Insufficient authorization validation between zones when xCAT zones are enabled
xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any nod…
-
Medium 4.4
Incorrect Authorization in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a file parameter through the CLI, potentially allowing attackers with access to …
-
High 7.0
Incorrect Authorization in Jenkins Core
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions for newly created files when uploading a plugin for installation, potentially allowing attackers with access to the Jen…
-
High 8.1
There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited…
-
Medium 5.0
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which send…
-
Medium 4.3
Insufficient verification of authorisation when accessing subresults in thmmniii/fbs-core
thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to query `subresults` from other users due to insufficient authorisation. This is only possible for logged-in users and it …
-
Unscored —
WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library au…
-
Medium 5.4
XWiki Platform allows macro execution as any user without programming rights through the context macro
XWiki Platform is a generic wiki platform. Starting in version 3.0-milestone-1, it's possible to execute a script with the right of another user, provided the target user does not have programming right. The problem has been patched in XWiki 14.8-rc-1, 14.4.5…
-
High 7.7
Secured properties in API Platform Core may be accessible within collections
API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiProperty` attribute can be disclosed to unauthorized users. The problem affects most…
-
Medium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be ab…
-
Medium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.2. An app may be ab…
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11…
-
High 7.5
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible t…
-
Medium 6.5
Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to ac…
-
Critical 9.8
TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
-
Critical 9.8
Privilege escalation in MOSN
Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
-
Critical 9.1
Argo CD users with any cluster secret update access may update out-of-bounds cluster secrets
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All Argo CD versions starting with 2.3.0-rc1 and prior to 2.3.17, 2.4.23 2.5.11, and 2.6.2 are vulnerable to an improper authorization bug which allows users who have the ability to upd…
-
Medium 5.3
containerd supplementary groups are not set up properly
containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supp…
-
Medium 6.5
Missing Authorization in Jenkins Azure Credentials Plugin
A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
-
High 7.3
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
KEV Feb 14, 2023 -
Medium 6.9
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an …
-
High 8.8
Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and ex…
-
High 7.2
In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the admin…
-
Medium 4.3
[20230102] - Core - Missing ACL checks for com_actionlogs
An issue was discovered in Joomla! 4.0.0 through 4.2.4. A missing ACL check allows non super-admin users to access com_actionlogs.
-
Critical 10.0CVE-2023-23924 Public exploit
URI validation failure on SVG parsing in Dompdf
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can e…
-
High 8.8
Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3. iotdb-web-workbench is an optional component of IoTDB, providing a web console of the database. Th…
-
Critical 9.1
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server…