cve.bz

CWE-639: Authorization Bypass Through User-Controlled Key, page 67

Filter

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

What the weakness is: CWE-639 at MITRE

Ask an AI about CWE-639

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-639: Authorization Bypass Through User-Controlled Key and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/639.html and https://cve.bz/cve/cwe/639?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2017-15208EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.

  2. 4.3CVE-2017-15207EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.

  3. 4.3CVE-2017-15206EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.

  4. 4.3CVE-2017-15204EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.

  5. 4.3CVE-2017-15203EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.

  6. 4.3CVE-2017-15202EPSS 1.0%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.

  7. 4.3CVE-2017-15201EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.

  8. 4.3CVE-2017-15200EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.

  9. 4.3CVE-2017-15199EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.

  10. 4.3CVE-2017-15197EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.

  11. 4.3CVE-2017-15196EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.

  12. 4.3CVE-2017-15195EPSS 1.2%

    In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.

  13. 6.3CVE-2017-0882EPSS 1.1%

    Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC.

  14. 5.4CVE-2012-5571EPSS 2.1%

    A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens …