cve.bz

CWE-862: Missing Authorization, page 194

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.8CVE-2023-21133EPSS 0.1%

    In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been fac…

  2. 6.8CVE-2023-21132EPSS 0.1%

    In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been fac…

  3. 6.5CVE-2023-4106EPSS 0.4%

    Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.

  4. 4.3CVE-2023-4105EPSS 0.4%

    Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message

  5. 9.8CVE-2023-39966EPSS 0.8%

    1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called …

  6. 5.5CVE-2023-40216EPSS 0.1%

    OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.

  7. 4.3CVE-2023-4282EPSS 0.5%

    The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible…

  8. 8.2CVE-2023-37862EPSS 0.5%

    In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial…

  9. 7.5CVE-2023-37860EPSS 0.8%

    In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.

  10. 6.5CVE-2023-37492EPSS 0.5%

    SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BAS…

  11. 5.5CVE-2023-33912EPSS 0.08%

    In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  12. 5.5CVE-2023-33911EPSS 0.08%

    In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  13. 5.5CVE-2023-33910EPSS 0.08%

    In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  14. 5.5CVE-2023-33909EPSS 0.08%

    In Contacts service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  15. 5.5CVE-2023-33908EPSS 0.08%

    In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  16. 5.5CVE-2023-33907EPSS 0.08%

    In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  17. 5.5CVE-2023-33906EPSS 0.08%

    In Contacts Service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  18. 7.5CVE-2023-38494EPSS 0.5%

    MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS …

  19. 5.9CVE-2023-30950EPSS 0.4%

    The foundry campaigns service was found to be vulnerable to an unauthenticated information disclosure in a rest endpoint

  20. 6.5CVE-2023-4124EPSS 0.7%

    Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1.

  21. 4.3CVE-2023-3426EPSS 0.6%

    The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

  22. 4.3CVE-2023-38989EPSS 0.4%

    An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Administrator's role information.

  23. 6.5CVE-2023-0958EPSS 0.7%

    Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions…

  24. 8.1CVE-2023-38510EPSS 0.6%

    Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassi…

  25. 9.8CVE-2023-3956EPSS 1.0%

    The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. Th…

  26. 7.5CVE-2023-3442EPSS 0.7%

    A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply…

  27. 6.5CVE-2022-43712EPSS 0.5%

    POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data …

  28. 6.5CVE-2023-37049EPSS 0.7%

    emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.

  29. 9.8CVE-2023-26301EPSS 0.8%

    Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.

  30. 5.3CVE-2023-3300EPSS 0.6%

    HashiCorp Nomad and Nomad Enterprise 0.11.0 up to 1.5.6 and 1.4.1 HTTP search API can reveal names of available CSI plugins to unauthenticated users or users without the plugin:read policy. Fixed in 1.6.0, 1.5.7, and 1.4.1.

  31. 3.8CVE-2023-3072EPSS 0.4%

    HashiCorp Nomad and Nomad Enterprise 0.7.0 up to 1.5.6 and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1.4.11.

  32. 8.8CVE-2023-33265EPSS 0.7%

    In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

  33. 8.8CVE-2023-3714EPSS 0.9%

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attacke…

  34. 8.8CVE-2023-3713EPSS 0.8%

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible…

  35. 4.3CVE-2023-3403EPSS 0.6%

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated att…

  36. 2.7CVE-2023-3587EPSS 0.4%

    Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions.

  37. 7.5CVE-2023-2268EPSS 0.7%

    Plane version 0.7.1 allows an unauthenticated attacker to view all stored server files of all users.

  38. 7.8CVE-2023-21257EPSS 0.09%

    In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privi…

  39. 7.8CVE-2023-21248EPSS 0.09%

    In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no addition…

  40. 7.8CVE-2023-21247EPSS 0.09%

    In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no add…

  41. 7.1CVE-2023-37965EPSS 0.7%

    A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, ca…

  42. 5.4CVE-2023-37963EPSS 0.5%

    A missing permission check in Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` fil…

  43. 6.5CVE-2023-37959EPSS 0.5%

    A missing permission check in Jenkins Sumologic Publisher Plugin 2.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

  44. 6.5CVE-2023-37956EPSS 0.6%

    A missing permission check in Jenkins Test Results Aggregator Plugin 1.2.13 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

  45. 6.5CVE-2023-37953EPSS 0.7%

    A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing …

  46. 4.3CVE-2023-37950EPSS 0.5%

    A missing permission check in Jenkins mabl Plugin 0.0.46 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  47. 7.1CVE-2023-37949EPSS 0.6%

    A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method…

  48. 4.3CVE-2023-37945EPSS 0.4%

    A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attackers with Overall/Read permission to download a string representation of the current security realm.

  49. 6.5CVE-2023-37944EPSS 0.8%

    A missing permission check in Jenkins Datadog Plugin 5.4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturin…

  50. 5.5CVE-2023-33902EPSS 0.2%

    In bluetooth service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.