cve.bz

CWE-1220: Insufficient Granularity of Access Control, page 3

Filter

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack the required granularity

What the weakness is: CWE-1220 at MITRE

Ask an AI about CWE-1220

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-1220: Insufficient Granularity of Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1220.html and https://cve.bz/cve/cwe/1220?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2024-8927EPSS 1.1%

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this var…

  2. 6.5CVE-2024-6867EPSS 0.4%

    An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As …

  3. 8.8CVE-2024-42365ExploitEPSS 4.7%

    Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may chang…

  4. 3.8CVE-2024-39324EPSS 0.4%

    aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API whi…

  5. 7.1CVE-2024-39323EPSS 0.4%

    aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over…

  6. 8.1CVE-2024-5389EPSS 0.4%

    In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the ap…

  7. 7.8CVE-2023-45217EPSS 0.2%

    Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 8.8CVE-2023-40070EPSS 0.2%

    Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 9.8CVE-2023-43040EPSS 3.1%

    IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

  10. 6.5CVE-2024-29200EPSS 0.6%

    Kimai is a web-based multi-user time-tracking application. The permission `view_other_timesheet` performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the `view_other_timesheet` per…

  11. 6.5CVE-2023-32259EPSS 0.3%

    Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ser…

  12. 5.5CVE-2023-6725EPSS 0.2%

    An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploi…

  13. 3.9CVE-2024-26246EPSS 0.6%

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

  14. 5.3CVE-2024-2412EPSS 0.4%

    The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.

  15. 5.0CVE-2023-50713EPSS 0.4%

    Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' …

  16. 7.8CVE-2023-44285EPSS 0.2%

    Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to …

  17. 6.5CVE-2023-4456EPSS 0.6%

    A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the …

  18. 4.3CVE-2023-39418EPSS 1.1%

    A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not…

  19. 8.1CVE-2023-33127EPSS 1.9%

    .NET and Visual Studio Elevation of Privilege Vulnerability

  20. 5.7CVE-2023-3227EPSS 0.4%

    Insufficient Granularity of Access Control in GitHub repository fossbilling/fossbilling prior to 0.5.0.

  21. 7.7CVE-2023-0205EPSS 0.5%

    NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.

  22. 7.7CVE-2023-0203EPSS 0.5%

    NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.

  23. 7.5CVE-2023-27591EPSS 0.8%

    Miniflux is a feed reader. Prior to version 2.0.43, an unauthenticated user can retrieve Prometheus metrics from a publicly reachable Miniflux instance where the `METRICS_COLLECTOR` configuration option is enabled and `METRICS_ALLOWED_NETW…

  24. 4.3CVE-2022-4813EPSS 0.6%

    Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

  25. 5.3CVE-2022-4801EPSS 0.7%

    Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

  26. 8.8CVE-2022-2475EPSS 0.7%

    Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the "Ethernet Q Commands" service. Any user is able to write macros into registers outside of the authorized accessible range. This could all…

  27. 8.8CVE-2022-36110EPSS 0.9%

    Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, t…

  28. 6.5CVE-2022-1461EPSS 0.9%

    Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.

  29. 4.3CVE-2022-1177EPSS 0.9%

    Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.

  30. 10.0CVE-2021-31384EPSS 1.2%

    Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web a…