CWE-639: Authorization Bypass Through User-Controlled Key, page 60
Filter
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
What the weakness is: CWE-639 at MITRE
Ask an AI about CWE-639
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2023-2713EPSS 0.8%
Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass. This issue affects Rental Module: before 23…
- 9.8CVE-2023-2276EPSS 1.1%
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled…
- 7.2CVE-2023-2548EPSS 0.7%
The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authoriza…
- 9.8CVE-2023-31182EPSS 0.6%
EasyTor Applications – Authorization Bypass - EasyTor Applications may allow authorization bypass via unspecified method.
- 5.4CVE-2023-30216EPSS 0.3%
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information.
- 4.5CVE-2023-30550EPSS 0.7%
MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other proj…
- 8.1CVE-2023-28656EPSS 0.5%
NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- 4.3CVE-2023-1911EPSS 0.5%
The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are already public and can be viewed, allowing any authenticated users, such as subscriber to access draft posts for example
- 6.5CVE-2023-1125EPSS 0.6%
The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own.
- 8.8CVE-2023-2260EPSS 0.9%
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- 6.5CVE-2022-48313EPSS 0.2%
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
- 7.5CVE-2018-17455EPSS 0.6%
An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure di…
- 7.5CVE-2018-17449EPSS 0.8%
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. Remote attackers could obtain sensitive information about issues, comments, and project titles via events API…
- 6.5CVE-2022-45175EPSS 0.7%
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in th…
- 4.3CVE-2023-1417EPSS 0.7%
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unre…
- 6.5CVE-2023-0967EPSS 0.7%
Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator. This is possible because the application is vuln…
- 7.1CVE-2023-1750EPSS 0.5%
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could retrieve device history, set device settings, and retrieve device information.
- 6.5CVE-2023-1749EPSS 0.5%
The listed versions of Nexx Smart Home devices lack proper access control when executing actions. An attacker with a valid NexxHome deviceId could send API requests that the affected devices would execute.
- 8.1CVE-2023-26984EPSS 0.9%
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.
- 5.3CVE-2023-24842EPSS 0.6%
HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access partial content of another user’s mail by changing user ID and mail ID within URL.
- 6.5CVE-2023-24834EPSS 0.6%
WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can exploit this vulnerability to access files belonging to other users by modifying the file ID within UR…
- 6.5CVE-2023-24625EPSS 1.1%
Faveo 5.0.1 allows remote attackers to obtain sensitive information via a modified user ID in an Insecure Direct Object Reference (IDOR) attack.
- 7.1CVE-2023-28686EPSS 0.7%
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the vict…
- 4.3CVE-2023-28334EPSS 0.6%
Authenticated users were able to enumerate other users' names via the learning plans page.
- 8.8CVE-2023-1462EPSS 0.7%
Authorization Bypass Through User-Controlled Key vulnerability in Vadi Corporate Information Systems DigiKent allows Authentication Bypass, Authentication Abuse. This issue affects DigiKent: before 23.03.20.
- 8.8CVE-2023-0865EPSS 1.2%
The WooCommerce Multiple Customer Addresses & Shipping WordPress plugin before 21.7 does not ensure that the address to add/update/retrieve/delete and duplicate belong to the user making the request, or is from a high privilege users, allo…
- 5.4CVE-2023-1463EPSS 0.5%
Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
- 6.5CVE-2023-28109EPSS 0.7%
Play With Docker is a browser-based Docker playground. Versions 0.0.2 and prior are vulnerable to domain hijacking. Because CORS configuration was not correct, an attacker could use `play-with-docker.com` as an example and set the origin h…
- 5.3CVE-2021-36400EPSS 0.5%
In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
- 7.5CVE-2023-25403EPSS 0.7%
CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. The program uses a fixed JWT key, and the stored key uses username format characters. Any user who logged in within 24 hours. A token can be forged with his username t…
- 8.8CVE-2023-0882EPSS 0.7%
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
- 5.3CVE-2023-25160EPSS 0.5%
Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should…
- 7.5CVE-2022-34138EPSS 0.6%
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.
- 9.8CVE-2023-0558EPSS 0.9%
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers …
- 8.1CVE-2023-0550EPSS 0.6%
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that …
- 6.5CVE-2021-36539EPSS 0.9%
Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).
- 8.8CVE-2022-45927EPSS 1.9%
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS endpoints of the Content Server. These endpoints can be used to create objects …
- 7.5CVE-2022-40319ExploitEPSS 7.4%
The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL. The impact is unauthorized modification of a victim's LISTSERV account.
- 4.3CVE-2023-22471EPSS 0.5%
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workar…
- 6.5CVE-2022-4812EPSS 0.6%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 5.4CVE-2022-4811EPSS 0.6%
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
- 5.3CVE-2022-4806EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 8.8CVE-2022-4803EPSS 0.9%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 5.4CVE-2022-4802EPSS 0.6%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 6.5CVE-2022-4799EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 5.3CVE-2022-4798EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- 7.8CVE-2022-46179EPSS 0.3%
LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GITHUB_ACTIONS environment variable to anything other than null or true and skip au…
- 9.8CVE-2022-4686EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
- 7.5CVE-2022-3805ExploitEPSS 1.7%
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obta…
- 4.3CVE-2022-3794EPSS 0.7%
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and m…