Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5562 vulnerabilities reference this CWE, most recent first.
GHSA-499P-G3JM-62MP
Vulnerability from github – Published: 2026-04-01 03:31 – Updated: 2026-04-01 03:31
VLAI
Details
XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-71278"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-01T01:16:40Z",
"severity": "HIGH"
},
"details": "XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.",
"id": "GHSA-499p-g3jm-62mp",
"modified": "2026-04-01T03:31:40Z",
"published": "2026-04-01T03:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71278"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request"
},
{
"type": "WEB",
"url": "https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-49JR-P97X-4C27
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37
VLAI
Details
The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-18095"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-19T14:29:00Z",
"severity": "MODERATE"
},
"details": "The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability.",
"id": "GHSA-49jr-p97x-4c27",
"modified": "2022-05-13T01:37:13Z",
"published": "2022-05-13T01:37:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18095"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/CRUC-8178"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103207"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49P4-5FQ3-8PQ9
Vulnerability from github – Published: 2023-11-15 00:31 – Updated: 2023-11-15 00:31
VLAI
Details
An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-45626"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-14T23:15:11Z",
"severity": "MODERATE"
},
"details": "An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across boot cycles.\n\n",
"id": "GHSA-49p4-5fq3-8pq9",
"modified": "2023-11-15T00:31:08Z",
"published": "2023-11-15T00:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45626"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-017.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-4C52-GF37-2PFP
Vulnerability from github – Published: 2022-05-13 01:47 – Updated: 2022-05-13 01:47
VLAI
Details
Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2017-8907"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-14T20:29:00Z",
"severity": "HIGH"
},
"details": "Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.",
"id": "GHSA-4c52-gf37-2pfp",
"modified": "2022-05-13T01:47:46Z",
"published": "2022-05-13T01:47:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-8907"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99090"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4C8G-JVCX-V4HV
Vulnerability from github – Published: 2026-06-16 19:04 – Updated: 2026-06-16 19:04
VLAI
Summary
Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access
Details
Summary
In Deno, environment access is gated by the env permission. You can deny it
with --deny-env, or restrict it to a specific allowlist with
--allow-env=FOO,BAR. The expectation is that a program running without env
permission cannot change process.env.
process.loadEnvFile() (the Node-compatible API for loading variables from a
.env file) does not honor this. It only checks that the program has
read permission for the dotenv file, then writes every key in that file
into the process environment — even when env access is denied.
In effect, --allow-read plus a writable or attacker-controlled .env file
is enough to defeat --deny-env.
Am I affected?
You are potentially affected if all of the following are true:
- You run Deno v2.3.0 or newer.
- Your program (or any dependency it imports) calls
process.loadEnvFile()fromnode:process. - You rely on Deno's permission model — specifically
--deny-env, an--allow-env=…allowlist, or running without grantingenv— as a security boundary. - The
.envpath passed toloadEnvFile()can be controlled or modified by a less-trusted party (untrusted input, user-writable directory, third-party dependency, etc.) and is covered by your--allow-readgrant.
If your program does not use process.loadEnvFile() at all, or if it already
grants full env access, this advisory does not change your risk.
Severity
5.2 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.8.0"
},
"package": {
"ecosystem": "crates.io",
"name": "deno"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49983"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-16T19:04:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nIn Deno, environment access is gated by the `env` permission. You can deny it\nwith `--deny-env`, or restrict it to a specific allowlist with\n`--allow-env=FOO,BAR`. The expectation is that a program running without `env`\npermission cannot change `process.env`.\n\n`process.loadEnvFile()` (the Node-compatible API for loading variables from a\n`.env` file) does **not** honor this. It only checks that the program has\n**read** permission for the dotenv file, then writes every key in that file\ninto the process environment \u2014 even when `env` access is denied.\n\nIn effect, **`--allow-read` plus a writable or attacker-controlled `.env` file\nis enough to defeat `--deny-env`.**\n\n## Am I affected?\n\nYou are potentially affected if **all** of the following are true:\n\n1. You run Deno **v2.3.0 or newer**.\n2. Your program (or any dependency it imports) calls `process.loadEnvFile()`\n from `node:process`.\n3. You rely on Deno\u0027s permission model \u2014 specifically `--deny-env`, an\n `--allow-env=\u2026` allowlist, or running without granting `env` \u2014 as a\n security boundary.\n4. The `.env` path passed to `loadEnvFile()` can be controlled or modified by\n a less-trusted party (untrusted input, user-writable directory, third-party\n dependency, etc.) and is covered by your `--allow-read` grant.\n\nIf your program does not use `process.loadEnvFile()` at all, or if it already\ngrants full `env` access, this advisory does not change your risk.",
"id": "GHSA-4c8g-jvcx-v4hv",
"modified": "2026-06-16T19:04:57Z",
"published": "2026-06-16T19:04:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-4c8g-jvcx-v4hv"
},
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Deno: process.loadEnvFile() bypasses env permission checks and mutates process.env with only read access"
}
GHSA-4CF5-XMHP-3XJ7
Vulnerability from github – Published: 2022-06-30 00:00 – Updated: 2022-07-11 19:25
VLAI
Summary
Improper Authorization in Apache Shiro
Details
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.shiro:shiro-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-32532"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T19:52:31Z",
"nvd_published_at": "2022-06-29T00:15:00Z",
"severity": "CRITICAL"
},
"details": "Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.",
"id": "GHSA-4cf5-xmhp-3xj7",
"modified": "2022-07-11T19:25:50Z",
"published": "2022-06-30T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32532"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/shiro"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in Apache Shiro"
}
GHSA-4CM7-7R9P-HQ66
Vulnerability from github – Published: 2022-12-15 21:30 – Updated: 2025-04-21 15:31
VLAI
Details
An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-42849"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-15T19:15:00Z",
"severity": "HIGH"
},
"details": "An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2, watchOS 9.2. A user may be able to elevate privileges.",
"id": "GHSA-4cm7-7r9p-hq66",
"modified": "2025-04-21T15:31:10Z",
"published": "2022-12-15T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42849"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213530"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213535"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213536"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/20"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/26"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4CMX-HRQ9-C23P
Vulnerability from github – Published: 2018-08-15 20:03 – Updated: 2023-04-21 18:30
VLAI
Summary
Improper Authorization in aedes
Details
Versions of aedes before 0.35.1 does not respect its own authorization rules when a client sets a Last Will.
Recommendation
Update to version 0.35.1 or later.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "aedes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.35.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3778"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:58:11Z",
"nvd_published_at": "2018-08-08T20:29:00Z",
"severity": "MODERATE"
},
"details": "Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.\n\n\n## Recommendation\n\nUpdate to version 0.35.1 or later.",
"id": "GHSA-4cmx-hrq9-c23p",
"modified": "2023-04-21T18:30:53Z",
"published": "2018-08-15T20:03:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3778"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/issues/211"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/issues/212"
},
{
"type": "WEB",
"url": "https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8"
},
{
"type": "PACKAGE",
"url": "https://github.com/moscajs/aedes"
},
{
"type": "WEB",
"url": "https://github.com/nodejs/security-wg/blob/master/vuln/npm/457.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in aedes"
}
GHSA-4CVM-W5CQ-5GHX
Vulnerability from github – Published: 2025-09-03 00:30 – Updated: 2025-09-03 00:30
VLAI
Details
A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-9835"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-02T22:15:33Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of the argument orderId leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"id": "GHSA-4cvm-w5cq-5ghx",
"modified": "2025-09-03T00:30:56Z",
"published": "2025-09-03T00:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9835"
},
{
"type": "WEB",
"url": "https://github.com/ez-lbz/poc/issues/46"
},
{
"type": "WEB",
"url": "https://github.com/ez-lbz/poc/issues/46#issue-3354477952"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.322182"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.322182"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.641729"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4F4R-WGV2-JJVG
Vulnerability from github – Published: 2023-09-20 12:30 – Updated: 2023-10-27 19:00
VLAI
Summary
Quarkus HTTP vulnerable to incorrect evaluation of permissions
Details
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
Severity
8.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-vertx-http"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-undertow"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-csrf-reactive"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.16.11.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.6.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.quarkus:quarkus-keycloak-authorization"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-4853"
],
"database_specific": {
"cwe_ids": [
"CWE-148",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-21T16:58:20Z",
"nvd_published_at": "2023-09-20T10:15:14Z",
"severity": "HIGH"
},
"details": "A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.",
"id": "GHSA-4f4r-wgv2-jjvg",
"modified": "2023-10-27T19:00:20Z",
"published": "2023-09-20T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4853"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/issues/35785"
},
{
"type": "WEB",
"url": "https://github.com/quarkusio/quarkus/discussions/35940"
},
{
"type": "PACKAGE",
"url": "https://github.com/quarkusio/quarkus"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238034"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-002"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-4853"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7653"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6112"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:6107"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5480"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5479"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5446"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5337"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5310"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:5170"
},
{
"type": "WEB",
"url": "https://access.redhat.com/articles/11258"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Quarkus HTTP vulnerable to incorrect evaluation of permissions"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.