cve.bz

CWE-284: Improper Access Control, page 132

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Ask an AI about CWE-284

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-6758EPSS 0.7%

    A vulnerability was found in Thecosy IceCMS 2.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adplanet/PlanetCommentList of the component API. The manipulation leads to improper access …

  2. 5.4CVE-2023-47325EPSS 0.4%

    Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. A user with low privileges is able to navigate directly to the bin, revealing all deleted spaces. The user can then restore or permanently delete the …

  3. 5.3CVE-2023-47536EPSS 0.6%

    An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote un…

  4. 7.5CVE-2023-47579EPSS 0.6%

    Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the operating system.

  5. 5.4CVE-2023-6547EPSS 0.3%

    Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. This can happen if …

  6. 4.3CVE-2023-49874EPSS 0.4%

    Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest to update the tasks of a private playbook run if they know the run ID.

  7. 7.1CVE-2022-48615EPSS 0.3%

    An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information.

  8. 6.5CVE-2023-6578EPSS 0.7%

    A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch t…

  9. 4.3CVE-2023-45210EPSS 0.5%

    Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.

  10. 7.1CVE-2023-2861EPSS 0.4%

    A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creati…

  11. 7.8CVE-2023-33071EPSS 0.1%

    Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.

  12. 7.8CVE-2023-39257EPSS 0.2%

    Dell Rugged Control Center, version prior to 4.7, contains an Improper Access Control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder when product ins…

  13. 7.8CVE-2023-39256EPSS 0.2%

    Dell Rugged Control Center, version prior to 4.7, contains an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability to modify the content in an unsecured folder during product i…

  14. 3.3CVE-2023-43089EPSS 0.2%

    Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. A local malicious standard user could potentially exploit this vulnerability to modify the content of the policy file, leading to una…

  15. 7.8CVE-2023-49694EPSS 0.5%

    A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the sec…

  16. 5.8CVE-2023-32065EPSS 0.5%

    OroCommerce is an open-source Business to Business Commerce application built with flexibility in mind. Detailed Order totals information may be received by Order ID. This issue is patched in version 5.0.11 and 5.1.1.

  17. 4.3CVE-2023-32064EPSS 0.5%

    OroCommerce package with customer portal and non authenticated visitor website base features. Back-office users can access information about Customer and Customer User menus, bypassing ACL security restrictions due to insufficient security…

  18. 5.0CVE-2023-32063EPSS 0.5%

    OroCalendarBundle enables a Calendar feature and related functionality in Oro applications. Back-office users can access information from any call event, bypassing ACL security restrictions due to insufficient security checks. This issue h…

  19. 4.3CVE-2023-32062EPSS 0.5%

    OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability…

  20. 4.3CVE-2023-6202EPSS 0.4%

    Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of another user to get their information (e.g. name, surname, nickname) via Matterm…

  21. 4.3CVE-2023-47865EPSS 0.4%

    Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also overrid…

  22. 7.8CVE-2023-44290EPSS 0.2%

    Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability while repairing/changing installation, leading to privilege es…

  23. 7.8CVE-2023-44289EPSS 0.2%

    Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability while repairing/changing installation, leading to privilege e…

  24. 7.8CVE-2023-43086EPSS 0.2%

    Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files inside installation folder during application upgrade, leading to privilege escala…

  25. 7.8CVE-2023-39253EPSS 0.2%

    Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of p…

  26. 8.8CVE-2023-5299EPSS 0.5%

    A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system.

  27. 2.7CVE-2023-48303EPSS 0.7%

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, admins can change authen…

  28. 7.1CVE-2023-48239EPSS 0.9%

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and starting in version 20.0.0 and prior to versions 20.0…

  29. 7.5CVE-2023-26347ExploitEPSS 10%

    Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability…

  30. 7.8CVE-2023-44292EPSS 0.2%

    Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges.

  31. 7.8CVE-2023-44282EPSS 0.2%

    Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module. A local low-privileged attacker could potentially exploit this vulnerability, leading to gaining escalated privileges.

  32. 7.8CVE-2023-39259EPSS 0.2%

    Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator user could potentially exploit this vulnerability, leading to the elevation of p…

  33. 7.1CVE-2023-31100EPSS 0.2%

    Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technology™ 4: * from 4.3.0.0 before 4.3.0.203 * from 4.3.1.0 before 4.3.1.…

  34. 5.3CVE-2023-41570EPSS 0.5%

    MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API.

  35. 7.5CVE-2023-39228EPSS 0.7%

    Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.

  36. 8.8CVE-2023-39221EPSS 0.4%

    Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access.

  37. 7.8CVE-2023-38411EPSS 0.2%

    Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  38. 5.5CVE-2023-33872EPSS 0.2%

    Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable information disclosure via local access.

  39. 7.5CVE-2023-32279EPSS 0.6%

    Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.2 may allow unauthenticated user to potentially enable information disclosure via network access.

  40. 7.8CVE-2023-32204EPSS 0.2%

    Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.

  41. 7.8CVE-2023-29157EPSS 0.2%

    Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.

  42. 7.8CVE-2023-28397EPSS 0.2%

    Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation of privileges via local access.

  43. 4.6CVE-2023-27879EPSS 0.3%

    Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.

  44. 7.2CVE-2023-22448EPSS 0.5%

    Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network access.

  45. 7.5CVE-2023-22285EPSS 0.7%

    Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access.

  46. 7.8CVE-2022-41689EPSS 0.2%

    Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated user to potentially enable escalation of privilege via local access.

  47. 4.4CVE-2022-41659EPSS 0.2%

    Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access.

  48. 7.8CVE-2022-38786EPSS 0.2%

    Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  49. 6.7CVE-2022-36396EPSS 0.2%

    Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.0017 may allow a privileged user to potentially enable escalation of privilege via local access.

  50. 6.7CVE-2022-36374EPSS 0.2%

    Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privileged user to potentially enable escalation of privilege via local access.