cve.bz

CWE-862: Missing Authorization, page 192

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2023-44212EPSS 0.4%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 31477.

  2. 7.1CVE-2023-44211EPSS 0.3%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 31637, Acronis Cyber Protect 16 (Linux, Windows) be…

  3. 5.5CVE-2023-44210EPSS 0.4%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29258, Acronis Cyber Protect 17 (Linux, macOS, Wind…

  4. 6.5CVE-2023-40376EPSS 0.6%

    IBM UrbanCode Deploy (UCD) 7.1 - 7.1.2.12, 7.2 through 7.2.3.5, and 7.3 through 7.3.2.0 under certain configurations could allow an authenticated user to make changes to environment variables due to improper authentication controls. IBM X…

  5. 9.1CVE-2023-44208EPSS 0.4%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.

  6. 5.3CVE-2023-3213EPSS 0.5%

    The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_print_page function in versions up to, and including, 3.8.0. This makes it possible for unauthenticated atta…

  7. 4.3CVE-2023-3770EPSS 0.4%

    Incorrect validation vulnerability of the data entered, allowing an attacker with access to the network on which the affected device is located to use the discovery port protocol (1925/UDP) to obtain device-specific information without the…

  8. 5.5CVE-2023-5321EPSS 0.3%

    Missing Authorization in GitHub repository hamza417/inure prior to build94.

  9. 4.3CVE-2023-2233EPSS 0.5%

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a proje…

  10. 9.1CVE-2023-43652EPSS 0.8%

    JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key …

  11. 9.8CVE-2023-20252EPSS 1.1%

    A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vu…

  12. 7.5CVE-2023-0456EPSS 0.6%

    A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorize…

  13. 8.8CVE-2023-5165EPSS 0.3%

    Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functional…

  14. 9.1CVE-2023-41296EPSS 0.4%

    Vulnerability of missing authorization in the kernel module. Successful exploitation of this vulnerability may affect integrity and confidentiality.

  15. 5.5CVE-2023-43090EPSS 0.3%

    A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot too…

  16. 9.8CVE-2023-43135EPSS 0.9%

    There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to t…

  17. 9.8CVE-2023-43134EPSS 0.9%

    There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend manag…

  18. 6.5CVE-2023-43501EPSS 0.6%

    A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

  19. 5.3CVE-2023-5054EPSS 0.6%

    The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct a…

  20. 9.8CVE-2023-0923EPSS 0.9%

    A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

  21. 4.3CVE-2023-4948EPSS 0.4%

    The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for aut…

  22. 3.3CVE-2023-42469EPSS 0.3%

    The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.se…

  23. 9.8CVE-2023-39073EPSS 1.1%

    An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.

  24. 5.4CVE-2023-40625EPSS 0.4%

    S4CORE (Manage Purchase Contracts App) - versions 102, 103, 104, 105, 106, 107, does not perform necessary authorization checks for an authenticated user. This could allow an attacker to perform unintended actions resulting in escalation o…

  25. 5.5CVE-2023-35677EPSS 0.10%

    In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution pri…

  26. 7.8CVE-2023-35665EPSS 0.1%

    In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…

  27. 9.8CVE-2023-36140EPSS 0.5%

    In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts.

  28. 4.3CVE-2023-4630EPSS 0.5%

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which any user can read limited information abo…

  29. 5.5CVE-2023-4104EPSS 0.3%

    An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups. *This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.…

  30. 5.3CVE-2023-40040EPSS 0.6%

    An issue was discovered in the MyCrops HiGrade "THC Testing & Cannabi" application 1.0.337 for Android. A remote attacker can start the camera feed via the com.cordovaplugincamerapreview.CameraActivity component in some situations. NOTE: t…

  31. 4.3CVE-2023-4792EPSS 0.5%

    The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2…

  32. 4.3CVE-2023-41947EPSS 0.4%

    A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frugal Testing using attacker-specified credentials.

  33. 8.8CVE-2023-41945EPSS 0.7%

    Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions a…

  34. 6.5CVE-2023-41943EPSS 0.6%

    Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to clear the SQS queue.

  35. 4.3CVE-2023-41941EPSS 0.4%

    A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins.

  36. 5.3CVE-2023-41908EPSS 0.4%

    Cerebrate before 1.15 lacks the Secure attribute for the session cookie.

  37. 4.3CVE-2023-4059EPSS 0.2%

    The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog

  38. 4.4CVE-2023-20833EPSS 0.09%

    In keyinstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: AL…

  39. 5.5CVE-2023-20826EPSS 0.08%

    In cta, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Patch ID:…

  40. 5.5CVE-2023-20825EPSS 0.08%

    In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Pat…

  41. 5.5CVE-2023-20824EPSS 0.08%

    In duraspeed, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privilege needed. User interaction is not needed for exploitation. Pat…

  42. 5.5CVE-2023-38466EPSS 0.08%

    In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  43. 5.5CVE-2023-38465EPSS 0.08%

    In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  44. 7.8CVE-2023-38464EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  45. 5.5CVE-2023-38463EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  46. 5.5CVE-2023-38462EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  47. 5.5CVE-2023-38461EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  48. 7.8CVE-2023-38460EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  49. 7.8CVE-2023-38459EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  50. 7.8CVE-2023-38458EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges