cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 63

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2021-46249EPSS 0.6%

    An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their ow…

  2. 5.3CVE-2022-0512EPSS 1.8%

    Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

  3. 6.5CVE-2021-3813EPSS 1.1%

    Improper Privilege Management in GitHub repository chatwoot/chatwoot prior to v2.2.

  4. 4.3CVE-2022-21713EPSS 1.2%

    Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view …

  5. 6.5CVE-2021-25096EPSS 1.0%

    The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the URL

  6. 9.8CVE-2022-22832ExploitEPSS 14%

    An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request.

  7. 7.5CVE-2021-41608EPSS 2.0%

    A file disclosure vulnerability in the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the value of the ID parameter in s…

  8. 7.5CVE-2022-22828EPSS 2.1%

    An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.

  9. 5.3CVE-2022-23856EPSS 1.0%

    An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI.

  10. 6.6CVE-2022-0266EPSS 1.1%

    Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.

  11. 4.3CVE-2021-44836EPSS 0.6%

    An issue was discovered in Delta RM 1.2. The /risque/risque/workflow/reset endpoint is lacking access controls, and it is possible for an unprivileged user to reopen a risk with a POST request, using the risqueID parameter to identify the …

  12. 7.5CVE-2021-3965EPSS 5.2%

    Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.

  13. 7.5CVE-2021-3852EPSS 0.8%

    growi is vulnerable to Authorization Bypass Through User-Controlled Key

  14. 9.8CVE-2021-45428ExploitEPSS 57%

    TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.

  15. 7.3CVE-2021-44160EPSS 1.1%

    Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform lim…

  16. 6.5CVE-2021-40579EPSS 0.9%

    https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact is: gain privileges (remote).

  17. 8.1CVE-2021-24739EPSS 1.0%

    The Logo Carousel WordPress plugin before 3.4.2 allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature

  18. 7.5CVE-2021-43828EPSS 1.4%

    PatrOwl is a free and open-source solution for orchestrating Security Operations. In versions prior to 1.77 an improper privilege management (IDOR) has been found in PatrowlManager. All imports findings file is placed under /media/imports/…

  19. 5.9CVE-2021-43820EPSS 1.0%

    Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sy…

  20. 9.8CVE-2021-44949EPSS 1.2%

    glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

  21. 4.3CVE-2021-39934EPSS 1.0%

    Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.…

  22. 4.3CVE-2021-39916EPSS 0.8%

    Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any External Status Check in GitLab EE starting from 14.1 before 14.3.6, all versions starting from 14.4 b…

  23. 5.9CVE-2021-3964EPSS 0.8%

    elgg is vulnerable to Authorization Bypass Through User-Controlled Key

  24. 6.5CVE-2021-3992EPSS 1.1%

    kimai2 is vulnerable to Improper Access Control

  25. 6.5CVE-2021-36329EPSS 0.7%

    Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information.

  26. 8.8CVE-2021-24892EPSS 1.9%

    Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of Wo…

  27. 7.5CVE-2021-22967EPSS 1.1%

    In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files …

  28. 7.5CVE-2021-22951EPSS 1.1%

    Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file…

  29. 6.5CVE-2021-3380EPSS 1.1%

    Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.

  30. 5.3CVE-2021-24840EPSS 1.2%

    The Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could…

  31. 7.5CVE-2021-41307EPSS 1.7%

    Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie C…

  32. 7.5CVE-2021-41306EPSS 1.6%

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Insecure Direct Object References (IDOR) vulnerability in the Average Time in Status Gadget. The af…

  33. 7.5CVE-2021-41305EPSS 1.2%

    Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filters via an Insecure Direct Object References (IDOR) vulnerability in the Average Number of Times in S…

  34. 8.1CVE-2021-39225EPSS 1.3%

    Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the …

  35. 7.5CVE-2021-36389EPSS 3.1%

    In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIImage.i4".

  36. 7.5CVE-2021-36388EPSS 3.2%

    In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulnerability exploitable by sending a specially crafted HTTP GET request to the page "MIIAvatarImage.i4".

  37. 5.4CVE-2021-36387EPSS 1.5%

    In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

  38. 7.5CVE-2021-20599EPSS 1.4%

    Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/1…

  39. 8.1CVE-2021-41129EPSS 1.8%

    Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmation_token` input during the two-factor authentication process to reference a cache value no…

  40. 7.5CVE-2021-41120EPSS 1.5%

    sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy…

  41. 4.3CVE-2021-39889EPSS 0.8%

    In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branc…

  42. 7.5CVE-2021-37777EPSS 1.7%

    Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive inf…

  43. 5.3CVE-2021-37331EPSS 1.0%

    Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control. On the Verifications page, after uploading an ID Card or Trade License and viewing it, ID Cards and Trade Licenses of other vendors/users can be viewed by c…

  44. 8.8CVE-2021-41847EPSS 1.6%

    An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user …

  45. 9.8CVE-2021-41301EPSS 2.0%

    ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information an…

  46. 8.8CVE-2021-41298EPSS 0.9%

    ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attackers with general user's privile…

  47. 8.8CVE-2021-36874EPSS 1.1%

    Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).

  48. 5.4CVE-2021-29773EPSS 0.7%

    IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability (IDOR). IBM X-Force ID: 202865.

  49. 6.5CVE-2021-38624EPSS 1.5%

    Windows Key Storage Provider Security Feature Bypass Vulnerability

  50. 8.8CVE-2021-40355EPSS 0.8%

    A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The affected applicat…