cve.bz

CWE-284: Improper Access Control, page 95

Filter

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

What the weakness is: CWE-284 at MITRE

Related attack patterns (CAPEC): 17
  • CAPEC-19 Embedding Scripts within Scripts Likelihood: High · Severity: High
  • CAPEC-441 Malicious Logic Insertion Likelihood: Medium · Severity: High
  • CAPEC-478 Modification of Windows Service Configuration Likelihood: Low · Severity: High
  • CAPEC-479 Malicious Root Certificate Likelihood: Low · Severity: Low
  • CAPEC-502 Intent Spoof
  • CAPEC-503 WebView Exposure
  • CAPEC-536 Data Injected During Configuration Likelihood: Low · Severity: High
  • CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment Likelihood: Low · Severity: Medium
  • CAPEC-550 Install New Service
  • CAPEC-551 Modify Existing Service
  • CAPEC-552 Install Rootkit Likelihood: Medium · Severity: High
  • CAPEC-556 Replace File Extension Handlers
  • CAPEC-558 Replace Trusted Executable Likelihood: Low · Severity: High
  • CAPEC-562 Modify Shared File
  • CAPEC-563 Add Malicious File to Shared Webroot
  • CAPEC-564 Run Software at Logon
  • CAPEC-578 Disable Security Software Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-284, as MITRE names them. Credits.

Ask an AI about CWE-284

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-284: Improper Access Control and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/284.html and https://cve.bz/cve/cwe/284?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2025-43495EPSS 0.2%

    The issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to monitor keystrokes without user permission.

  2. 5.2CVE-2025-43481EPSS 0.2%

    This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.

  3. 5.5CVE-2025-43477EPSS 0.2%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data.

  4. 7.8CVE-2025-43476EPSS 0.2%

    A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.

  5. 7.5CVE-2025-43454EPSS 0.5%

    This issue was addressed through improved state management. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. A device may persistently fail to lock.

  6. 7.5CVE-2025-43450EPSS 0.4%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1. An app may be able to learn information about the current camera view before being granted camera access.

  7. 6.2CVE-2025-43414EPSS 0.2%

    A permissions issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.

  8. 7.5CVE-2025-43413EPSS 0.6%

    An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1, watchOS 26.1. A sandboxed app may b…

  9. 6.3CVE-2025-43412EPSS 0.2%

    A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to break out of its sandbox.

  10. 2.4CVE-2025-43408EPSS 0.3%

    This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock s…

  11. 7.8CVE-2025-43407EPSS 0.2%

    This issue was addressed with improved entitlements. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. An app may be able t…

  12. 5.5CVE-2025-43396EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A sandboxed app may be able to access sensitive user data.

  13. 5.5CVE-2025-43335EPSS 0.2%

    The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.

  14. 5.5CVE-2025-43334EPSS 0.2%

    This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.

  15. 5.5CVE-2025-43322EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access user-sensitive data.

  16. 2.4CVE-2025-43309EPSS 0.2%

    A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.

  17. 2.0CVE-2025-12593EPSS 0.4%

    A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. The impacted element is an unknown function of the file /admin/edit_room.php of the component Photo Handler. The manipulation leads to unrestricted…

  18. 6.3CVE-2025-63562EPSS 0.2%

    Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by a…

  19. 10.0CVE-2025-29270EPSS 0.4%

    Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.

  20. 9.9CVE-2025-48983EPSS 0.8%

    A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

  21. 7.5CVE-2025-63423EPSS 0.3%

    Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 was discovered to store the Administrator password.

  22. 7.5CVE-2025-63422EPSS 0.3%

    Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitrarily change the administrator username and password via sending a crafted GET r…

  23. 7.5CVE-2025-61120EPSS 0.3%

    AG Life Logger Android App version v1.0.2.72 and before (package name com.donki.healthy), developed by IO FIT, K.K., contains improper access control vulnerabilities. Exposed credentials in traffic may allow attackers to misuse cloud resou…

  24. 7.5CVE-2025-61119EPSS 0.3%

    Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including ent…

  25. 7.5CVE-2025-61114EPSS 0.3%

    2nd Line Android App version v1.2.92 and before (package name com.mysecondline.app), developed by AutoBizLine, Inc., contains an improper access control vulnerability in its authentication mechanism. The server only validates the first cha…

  26. 7.5CVE-2025-61118EPSS 0.3%

    mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with se…

  27. 7.5CVE-2025-61117EPSS 0.3%

    Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain au…

  28. 7.5CVE-2025-61116EPSS 0.3%

    AdForest - Classified Android App version 4.0.12 (package name scriptsbundle.adforest), developed by Muhammad Jawad Arshad, contains an improper access control vulnerability in its authentication mechanism. The app uses a Base64-encoded em…

  29. 7.5CVE-2025-61115EPSS 0.4%

    ABC Fine Wine & Spirits Android App version v.11.27.5 and before (package name com.cta.abcfinewineandspirits), developed by ABC Liquors, Inc., contains an improper access control vulnerability in its login mechanism. The application does n…

  30. 7.5CVE-2025-61113EPSS 0.3%

    TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints. By modifying request parameters, attackers may obtain sensitive user information (such as device identifiers and birthdays) and access p…

  31. 9.8CVE-2025-43027EPSS 0.4%

    A critical severity vulnerability has been identified in the ALPR Manager role of Security Center that could allow attackers to gain administrative access to the Genetec Security Center system. The Genetec engineering team discovered this …

  32. 7.5CVE-2025-61234EPSS 0.3%

    Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Add…

  33. 7.8CVE-2025-61156EPSS 0.1%

    Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via an insecure IOCTL.

  34. 6.3CVE-2025-27093EPSS 0.3%

    Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to co…

  35. 7.5CVE-2025-60800EPSS 0.3%

    Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request.

  36. 7.5CVE-2025-60354EPSS 0.3%

    Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot.

  37. 5.5CVE-2025-12378EPSS 0.5%

    A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This issue affects some unknown processing of the file /addproduct.php. Performing manipulation of the argument photo results in unrestricted upload. The…

  38. 2.1CVE-2025-12347EPSS 0.4%

    A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/editor_files/save-file-ajax.php. Executing manipulation of the argument file_path/content can lead to …

  39. 2.1CVE-2025-12346EPSS 0.4%

    A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins/auto_post/uploads-require-maxsite.php of the component HTTP Header Handler. Performing manipulatio…

  40. 2.1CVE-2025-12344EPSS 0.3%

    A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewayServlet of the component Request Header Handler. Such manipulation of the argument ts/sign leads t…

  41. 2.0CVE-2025-12331EPSS 0.4%

    A weakness has been identified in Willow CMS up to 1.4.0. Impacted is an unknown function of the file /admin/images/add. This manipulation causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made…

  42. 5.4CVE-2025-60982EPSS 0.2%

    IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or mod…

  43. 5.5CVE-2025-12301EPSS 0.5%

    A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /editproduct.php. Such manipulation of the argument photo leads to unrestricted upload. The attack can…

  44. 6.5CVE-2025-54970EPSS 0.3%

    An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Status Service fails to authenticate requests. In some configurations, this may allow remote or local users to abort jobs or read information without the permission…

  45. 8.8CVE-2025-54968EPSS 0.4%

    An issue was discovered in BAE SOCET GXP before 4.6.0.2. The SOCET GXP Job Service does not require authentication. In some configurations, this may allow remote users to submit jobs, or local users to submit jobs that will execute with th…

  46. 2.1CVE-2025-12297EPSS 0.4%

    A vulnerability was detected in atjiu pybbs up to 6.0.0. This affects an unknown function of the file UserApiController.java. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now publi…

  47. 2.0CVE-2025-12291EPSS 0.3%

    A vulnerability was found in ashymuzuro Full-Ecommece-Website and Muzuro Ecommerce System up to 1.1.0. This affects an unknown part of the file /admin/index.php?add_product of the component Add Product Page. The manipulation results in unr…

  48. 5.3CVE-2023-37749EPSS 0.4%

    Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper authorization.

  49. 9.1CVE-2025-60291EPSS 0.3%

    An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). There is a permission control flaw that allows unauthorized attackers to access specific routes and modify database connection configurations.

  50. 2.1CVE-2025-12276EPSS 0.4%

    A vulnerability was detected in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. Affected by this issue is some unknown functionality of the component Image Handler. The manipulation results in information disclosure. The attack …