cve.bz

CWE-284: Improper Access Control, page 101

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.1CVE-2025-9397EPSS 0.5%

    A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executing manipulation of the argument files[] can lead to unrestricted upload. The attack can be launched …

  2. 0.3CVE-2025-9381EPSS 0.1%

    A security flaw has been discovered in FNKvision Y215 CCTV Camera 10.194.120.40. This affects an unknown part of the file /tmp/wpa_supplicant.conf. Performing manipulation results in information disclosure. The attack may be carried out on…

  3. 9.8CVE-2022-43110EPSS 0.7%

    Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface. An unauthenticated remote attacker can make changes to the system in…

  4. 9.8CVE-2024-53496EPSS 0.6%

    Incorrect access control in the doFilter function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.

  5. 7.3CVE-2025-55630EPSS 0.3%

    A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wrong username and password allows attackers to enumerate ex…

  6. 5.3CVE-2025-55626EPSS 0.2%

    An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers to access the Admin-only settings and edit the session st…

  7. 7.5CVE-2024-53494EPSS 0.4%

    Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication.

  8. 8.1CVE-2025-55741EPSS 0.4%

    UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard e…

  9. 9.8CVE-2025-53763EPSS 0.7%

    Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.

  10. 8.3CVE-2025-7051EPSS 0.3%

    On N-central, it is possible for any authenticated user to read, write and modify syslog configuration across customers on an N-central server. This vulnerability is present in all deployments of N-central prior to 2025.2.

  11. 9.1CVE-2024-45438EPSS 0.6%

    An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions usin…

  12. 5.3CVE-2025-55371EPSS 0.3%

    Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.

  13. 8.8CVE-2025-55368EPSS 0.4%

    Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

  14. 5.3CVE-2025-55367EPSS 0.3%

    Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

  15. 5.3CVE-2025-55366EPSS 0.3%

    Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.

  16. 2.0CVE-2025-9296EPSS 0.4%

    A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possibl…

  17. 8.1CVE-2025-27215EPSS 0.3%

    An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system. Affected Products: UniFi Connect Display Cast (Version 1.…

  18. 9.8CVE-2024-57155EPSS 0.4%

    Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token.

  19. 9.8CVE-2024-57154EPSS 0.4%

    Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index.

  20. 2.1CVE-2025-9240EPSS 0.3%

    A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The expl…

  21. 7.5CVE-2024-57152EPSS 0.4%

    Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication via the cn.luischen.interceptor.BaseInterceptor class

  22. 7.5CVE-2024-53495EPSS 0.4%

    Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authentication.

  23. 8.6CVE-2025-28041EPSS 0.3%

    Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication.

  24. 4.9CVE-2025-20131EPSS 0.3%

    A vulnerability in the GUI of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative privileges to upload files to an affected device. This vulnerability is due to improper validation of t…

  25. 9.8CVE-2024-57157EPSS 0.4%

    Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.

  26. 2.1CVE-2025-9153EPSS 0.5%

    A vulnerability was detected in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument photo results in unrestricted…

  27. 5.3CVE-2025-51539EPSS 0.7%

    EzGED3 3.5.0 contains an unauthenticated arbitrary file read vulnerability due to improper access control and insufficient input validation in a script exposed via the web interface. A remote attacker can supply a crafted path parameter to…

  28. 5.3CVE-2025-50434EPSS 0.2%

    A security issue has been identified in Appian Enterprise Business Process Management version 25.3. The vulnerability is related to incorrect access control, which under certain conditions could allow unauthorized access to information. NO…

  29. 5.3CVE-2025-51529EPSS 0.4%

    Incorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 allows remote attackers to cause a denial of service (database server resource exhaustion) via unlim…

  30. 4.3CVE-2025-50897EPSS 0.3%

    A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with write permissions (PTE_W) in SV39 mode may incorrectly trigger a Store/AMO access …

  31. 2.1CVE-2025-9139EPSS 0.3%

    A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The…

  32. 8.5CVE-2025-32992EPSS 0.2%

    Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control.

  33. 7.7CVE-2025-4962EPSS 0.2%

    An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another us…

  34. 2.1CVE-2025-9099EPSS 0.4%

    A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNewsImg. The manipulation of the argument File leads to unrestricted upload. It is p…

  35. 1.3CVE-2017-20199EPSS 0.5%

    A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack ma…

  36. 6.5CVE-2025-50861EPSS 0.3%

    The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to applicatio…

  37. 5.3CVE-2025-20219EPSS 0.4%

    A vulnerability in the implementation of access control rules for loopback interfaces in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticate…

  38. 2.1CVE-2025-8965EPSS 0.4%

    A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component E…

  39. 5.3CVE-2025-48861EPSS 0.3%

    A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.

  40. 8.0CVE-2025-48860EPSS 0.3%

    A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of…

  41. 7.1CVE-2025-55196EPSS 0.4%

    External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resour…

  42. 5.2CVE-2025-8762EPSS 0.2%

    A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack o…

  43. 7.8CVE-2025-53729EPSS 0.3%

    Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.

  44. 5.5CVE-2025-49707EPSS 0.4%

    Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

  45. 8.8CVE-2025-24999EPSS 1.8%

    Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

  46. 2.3CVE-2025-24840EPSS 0.2%

    Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

  47. 7.0CVE-2025-24323EPSS 0.2%

    Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before version MR4_1.0b1 may allow a privileged user to potentially enable escalation of privilege via local access.

  48. 6.7CVE-2025-24313EPSS 0.1%

    Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may allow a privileged user to potentially enable denial of service via local access.

  49. 5.4CVE-2025-20099EPSS 0.1%

    Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of privilege via local access.

  50. 8.5CVE-2025-55012EPSS 0.2%

    Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vu…