Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5657 vulnerabilities reference this CWE, most recent first.
GHSA-4WJJ-JWC9-2X96
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2025-06-05 21:58
VLAI
Summary
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
Details
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Severity
7.1 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2989"
],
"database_specific": {
"cwe_ids": [
"CWE-842",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-15T03:23:59Z",
"nvd_published_at": "2022-09-13T14:15:00Z",
"severity": "HIGH"
},
"details": "An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.",
"id": "GHSA-4wjj-jwc9-2x96",
"modified": "2025-06-05T21:58:44Z",
"published": "2022-09-14T00:00:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2989"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/15618"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/15677"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/pull/15696"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:7822"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8008"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2022:8431"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-2989"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2121445"
},
{
"type": "PACKAGE",
"url": "https://github.com/containers/podman"
},
{
"type": "WEB",
"url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Podman\u0027s incorrect handling of the supplementary groups may lead to data disclosure, modification"
}
GHSA-4WQ3-R6VG-34Q5
Vulnerability from github – Published: 2026-01-10 00:30 – Updated: 2026-01-14 21:34
VLAI
Details
Details
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).
On deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.
On deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the “Default authorization rules” defined in the Auth Chooser configuration. On most environments, it is expected that the “Default authorization rules" only add the Everyone group.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-62487"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-09T22:16:00Z",
"severity": "LOW"
},
"details": "### Details\nOn October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).\n\nOn deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.\n\nOn deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the \u201cDefault authorization rules\u201d defined in the Auth Chooser configuration. On most environments, it is expected that the \u201cDefault authorization rules\" only add the Everyone group.",
"id": "GHSA-4wq3-r6vg-34q5",
"modified": "2026-01-14T21:34:08Z",
"published": "2026-01-10T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62487"
},
{
"type": "WEB",
"url": "https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4X4M-3C2P-QPPC
Vulnerability from github – Published: 2025-08-27 18:31 – Updated: 2025-08-27 19:20
VLAI
Summary
Kubernetes Nodes can delete themselves by adding an OwnerReference
Details
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Severity
6.7 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.31.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c 1.32.7"
},
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.32.0-alpha.0"
},
{
"fixed": "1.32.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.33.0-alpha.0"
},
{
"fixed": "1.33.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-5187"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-27T19:20:29Z",
"nvd_published_at": "2025-08-27T17:15:48Z",
"severity": "MODERATE"
},
"details": "A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.",
"id": "GHSA-4x4m-3c2p-qppc",
"modified": "2025-08-27T19:20:29Z",
"published": "2025-08-27T18:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5187"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/133471"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Kubernetes Nodes can delete themselves by adding an OwnerReference"
}
GHSA-4X95-346P-G442
Vulnerability from github – Published: 2022-05-02 03:12 – Updated: 2024-01-12 21:30
VLAI
Details
parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2009-0034"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-01-30T19:30:00Z",
"severity": "MODERATE"
},
"details": "parse.c in sudo 1.6.9p17 through 1.6.9p19 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.",
"id": "GHSA-4x95-346p-g442",
"modified": "2024-01-12T21:30:17Z",
"published": "2022-05-02T03:12:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0034"
},
{
"type": "WEB",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=468923"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-2954"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10856"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6462"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2009/000060.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/51736"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33753"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33840"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33885"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35766"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2009-0021"
},
{
"type": "WEB",
"url": "http://www.gratisoft.us/bugzilla/show_bug.cgi?id=327"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:033"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2009-0267.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/500546/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/504849/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33517"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021688"
},
{
"type": "WEB",
"url": "http://www.sudo.ws/cgi-bin/cvsweb/sudo/parse.c.diff?r1=1.160.2.21\u0026r2=1.160.2.22\u0026f=h"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2009-0009.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1865"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4X95-P9F4-3P7R
Vulnerability from github – Published: 2023-04-27 21:30 – Updated: 2024-04-04 03:42
VLAI
Details
Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-37326"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-27T20:15:40Z",
"severity": "HIGH"
},
"details": "Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start API by controlling the pidfile field inside the DaemonJSON field in the WindowsContainerStartRequest class. This can indirectly lead to privilege escalation.",
"id": "GHSA-4x95-p9f4-3p7r",
"modified": "2024-04-04T03:42:59Z",
"published": "2023-04-27T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37326"
},
{
"type": "WEB",
"url": "https://docs.docker.com/desktop/release-notes/#docker-desktop-460"
},
{
"type": "WEB",
"url": "https://www.cyberark.com/resources/threat-research-blog/breaking-docker-named-pipes-systematically-docker-desktop-privilege-escalation-part-2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4XC7-X2JR-CR74
Vulnerability from github – Published: 2022-02-24 00:00 – Updated: 2022-03-03 22:06
VLAI
Summary
Improper Authorization in dolibarr/dolibarr
Details
Dolibarr allows improper access control issues in the userphoto modulepart. The impact could lead to data exposure as the attached files and documents may contain sensitive information of relevant parties such as contacts, suppliers, invoices, orders, stocks, agenda, accounting and more.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "16.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0731"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-03T22:06:43Z",
"nvd_published_at": "2022-02-23T19:15:00Z",
"severity": "MODERATE"
},
"details": "Dolibarr allows improper access control issues in the userphoto modulepart. The impact could lead to data exposure as the attached files and documents may contain sensitive information of relevant parties such as contacts, suppliers, invoices, orders, stocks, agenda, accounting and more.",
"id": "GHSA-4xc7-x2jr-cr74",
"modified": "2022-03-03T22:06:43Z",
"published": "2022-02-24T00:00:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0731"
},
{
"type": "WEB",
"url": "https://github.com/dolibarr/dolibarr/commit/209ab708d4b65fbd88ba4340d60b7822cb72651a"
},
{
"type": "PACKAGE",
"url": "https://github.com/dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/e242ab4e-fc70-4b2c-a42d-5b3ee4895de8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in dolibarr/dolibarr"
}
GHSA-4XPJ-PRJW-RC6P
Vulnerability from github – Published: 2024-09-10 03:31 – Updated: 2024-09-10 03:31
VLAI
Details
SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-44114"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T03:15:03Z",
"severity": "LOW"
},
"details": "SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application.",
"id": "GHSA-4xpj-prjw-rc6p",
"modified": "2024-09-10T03:31:31Z",
"published": "2024-09-10T03:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44114"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3507252"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4XQM-4P72-87H6
Vulnerability from github – Published: 2023-07-06 22:55 – Updated: 2023-07-06 22:55
VLAI
Summary
Sentry CORS misconfiguration
Details
Impact
The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends with the system.base-hostname option of Sentry installation. This only affects installations that have system.base-hostname option explicitly set, as it is empty by default.
Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.
Patches
The patch has been released in Sentry 23.6.2.
Workarounds
For Sentry SaaS customers, no action is needed.
For self-hosted Sentry installations that have system.base-hostname explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.
References
Credits
Severity
6.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sentry"
},
"ranges": [
{
"events": [
{
"introduced": "23.6.0"
},
{
"fixed": "23.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-36829"
],
"database_specific": {
"cwe_ids": [
"CWE-697",
"CWE-863",
"CWE-942"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T22:55:44Z",
"nvd_published_at": "2023-07-06T23:15:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default.\n\nImpact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.\n\n### Patches\nThe patch has been released in [Sentry 23.6.2](https://github.com/getsentry/self-hosted/releases/tag/23.6.2).\n\n### Workarounds\n\nFor Sentry SaaS customers, no action is needed.\n\nFor self-hosted Sentry installations that have `system.base-hostname` explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.\n\n### References\n- [getsentry/sentry PR #52276](https://github.com/getsentry/sentry/pull/52276)\n\n### Credits\n- [@andr0idp4r4n0id](https://twitter.com/andr0idp4r4n0id)",
"id": "GHSA-4xqm-4p72-87h6",
"modified": "2023-07-06T22:55:44Z",
"published": "2023-07-06T22:55:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-4xqm-4p72-87h6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36829"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/pull/52276"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/commit/19248fb9802c252665b802aeab02fdc65ed47dc9"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/commit/ee44c6be35e5e464bc40637580f39867898acd8b"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/self-hosted/releases/tag/23.6.2"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/sentry/PYSEC-2023-115.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Sentry CORS misconfiguration"
}
GHSA-4XV5-48M7-9QHQ
Vulnerability from github – Published: 2025-04-11 18:31 – Updated: 2025-07-07 15:30
VLAI
Details
Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.
Severity
5.4 (Medium)
10.0 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-32068"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-11T17:15:43Z",
"severity": "CRITICAL"
},
"details": "Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.",
"id": "GHSA-4xv5-48m7-9qhq",
"modified": "2025-07-07T15:30:32Z",
"published": "2025-04-11T18:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32068"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/q/I27b61af2cdfb862a42432e7a87b863033d540cfc"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T336113"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-4XVH-24FG-V9XX
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2022-05-13 01:48
VLAI
Details
An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2017-9653"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-14T16:29:00Z",
"severity": "CRITICAL"
},
"details": "An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.",
"id": "GHSA-4xvh-24fg-v9xx",
"modified": "2022-05-13T01:48:03Z",
"published": "2022-05-13T01:48:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9653"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-220-01"
},
{
"type": "WEB",
"url": "https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00324"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.