CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-73GM-85XF-8699
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-07-13 00:01Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500 before 1.0.3.43, DC112A before 1.0.0.40, DGN2200v4 before 1.0.0.108, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK40 before 2.3.0.28, RBR40 before 2.3.0.28, RBS40 before 2.3.0.28, R6020 before 1.0.0.34, R6080 before 1.0.0.34, R6120 before 1.0.0.44, R6220 before 1.1.0.80, R6230 before 1.1.0.80, R6250 before 1.0.4.34, R6260 before 1.1.0.40, R6850 before 1.1.0.40, R6350 before 1.1.0.40, R6400v2 before 1.0.2.62, R6700v3 before 1.0.2.62, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900v2 before 1.2.0.36, R7000 before 1.0.9.34, R6900P before 1.3.1.44, R7000P before 1.3.1.44, R7100LG before 1.0.0.48, R7200 before 1.2.0.48, R7350 before 1.2.0.48, R7400 before 1.2.0.48, R7450 before 1.2.0.36, AC2100 before 1.2.0.36, AC2400 before 1.2.0.36, AC2600 before 1.2.0.36, R7500v2 before 1.0.3.38, R7800 before 1.0.2.58, R7900 before 1.0.3.8, R7960P before 1.4.1.44, R8000 before 1.0.4.28, R7900P before 1.4.1.30, R8000P before 1.4.1.30, R8900 before 1.0.4.2, R9000 before 1.0.4.2, RAX120 before 1.0.0.74, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, WNR3500Lv2 before 1.2.0.56, XR450 before 2.3.2.32, and XR500 before 2.3.2.32.
{
"affected": [],
"aliases": [
"CVE-2021-38516"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T00:15:00Z",
"severity": "CRITICAL"
},
"details": "Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500 before 1.0.3.43, DC112A before 1.0.0.40, DGN2200v4 before 1.0.0.108, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK40 before 2.3.0.28, RBR40 before 2.3.0.28, RBS40 before 2.3.0.28, R6020 before 1.0.0.34, R6080 before 1.0.0.34, R6120 before 1.0.0.44, R6220 before 1.1.0.80, R6230 before 1.1.0.80, R6250 before 1.0.4.34, R6260 before 1.1.0.40, R6850 before 1.1.0.40, R6350 before 1.1.0.40, R6400v2 before 1.0.2.62, R6700v3 before 1.0.2.62, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900v2 before 1.2.0.36, R7000 before 1.0.9.34, R6900P before 1.3.1.44, R7000P before 1.3.1.44, R7100LG before 1.0.0.48, R7200 before 1.2.0.48, R7350 before 1.2.0.48, R7400 before 1.2.0.48, R7450 before 1.2.0.36, AC2100 before 1.2.0.36, AC2400 before 1.2.0.36, AC2600 before 1.2.0.36, R7500v2 before 1.0.3.38, R7800 before 1.0.2.58, R7900 before 1.0.3.8, R7960P before 1.4.1.44, R8000 before 1.0.4.28, R7900P before 1.4.1.30, R8000P before 1.4.1.30, R8900 before 1.0.4.2, R9000 before 1.0.4.2, RAX120 before 1.0.0.74, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, WNR3500Lv2 before 1.2.0.56, XR450 before 2.3.2.32, and XR500 before 2.3.2.32.",
"id": "GHSA-73gm-85xf-8699",
"modified": "2022-07-13T00:01:35Z",
"published": "2022-05-24T19:10:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38516"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000063780/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Routers-Gateways-and-WiFi-Systems-PSV-2020-0273"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-73GR-R64Q-7JH4
Vulnerability from github – Published: 2026-03-30 17:49 – Updated: 2026-03-30 17:49Summary
The categories.json.php endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no ?user= parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the ?user= parameter is supplied, a type confusion bug causes the filter to use the admin user's (user_id=1) group memberships instead of the current user's, rendering the filter ineffective.
Details
The vulnerability has two related failures in objects/categories.json.php and objects/category.php:
1. Default request — group filtering completely skipped
In categories.json.php:17-24, when $_GET['user'] is not set, $sameUserGroupAsMe defaults to false:
// categories.json.php:17-24
$onlyWithVideos = false;
$sameUserGroupAsMe = false;
if(!empty($_GET['user'])){
$onlyWithVideos = true;
$sameUserGroupAsMe = true;
}
$categories = Category::getAllCategories(true, $onlyWithVideos, false, $sameUserGroupAsMe);
In category.php:438-452, the user group filter is gated on $sameUserGroupAsMe being truthy:
// category.php:438-452
if ($sameUserGroupAsMe) {
$users_groups = UserGroups::getUserGroups($sameUserGroupAsMe);
$users_groups_id = array(0);
foreach ($users_groups as $value) {
$users_groups_id[] = $value['id'];
}
$sql .= " AND ("
. "(SELECT count(*) FROM categories_has_users_groups chug WHERE c.id = chug.categories_id) = 0 OR "
. "(SELECT count(*) FROM categories_has_users_groups chug2 WHERE c.id = chug2.categories_id AND users_groups_id IN (" . implode(',', $users_groups_id) . ")) >= 1 "
. ")";
}
Since $sameUserGroupAsMe = false, the entire block is skipped. All non-private categories are returned regardless of their user group restrictions set via the categories_has_users_groups table.
2. With ?user= parameter — boolean-to-integer type confusion
When $_GET['user'] is non-empty, $sameUserGroupAsMe is set to boolean true (line 21). This value is passed to UserGroups::getUserGroups($sameUserGroupAsMe) at category.php:440.
In userGroups.php:349-379, the parameter is used as $users_id:
// userGroups.php:349,371,379
public static function getUserGroups($users_id){
// ...
$sql = "SELECT uug.*, ug.* FROM users_groups ug"
. " LEFT JOIN users_has_users_groups uug ON users_groups_id = ug.id WHERE users_id = ? ";
// ...
$res = sqlDAL::readSql($sql, "i", [$users_id]);
PHP casts boolean true to integer 1 for the prepared statement bind, resulting in WHERE users_id = 1 — fetching the admin user's group memberships. The filter then allows categories visible to admin groups, effectively granting any unauthenticated user the admin's category visibility.
3. getTotalCategories also unfiltered
getTotalCategories() at category.php:978 does not accept a $sameUserGroupAsMe parameter at all, so the total count always reflects the unfiltered category set.
The endpoint requires no authentication — it uses allowOrigin() (a CORS header helper) and is publicly routable via the .htaccess rewrite rule: RewriteRule ^categories.json$ objects/categories.json.php.
PoC
# 1. Fetch all categories without authentication — no group filtering applied
curl -s 'https://target/categories.json' | jq '.rows[] | {id, name, private, users_groups_ids_array}'
# Returns ALL non-private categories including those restricted to specific user groups.
# The users_groups_ids_array field reveals which groups each category is restricted to.
# Categories with non-empty users_groups_ids_array should be hidden from users not in those groups.
# 2. Attempt the "filtered" path — still broken due to boolean->int cast
curl -s 'https://target/categories.json?user=1' | jq '.rows[] | {id, name, private, users_groups_ids_array}'
# This applies group filtering but uses admin's groups (users_id=1) instead of the
# current user's groups, so group-restricted categories visible to admin are exposed.
Impact
Any unauthenticated user can:
- Enumerate all non-private categories regardless of user group restrictions, bypassing the intended access control model where categories are restricted to specific user groups via the CustomizeUser plugin's
categories_has_users_groupstable. - Discover the user group configuration for each category via the
users_groups_ids_arrayfield in the response, revealing the internal access control structure. - Identify group-restricted content areas that should be hidden, which could be used to target further access control bypasses on the videos within those categories.
The severity is Medium because this is an information disclosure of category metadata (names, descriptions, icons, group assignments) rather than the actual video content within restricted categories. However, the exposure of the access control structure itself (which groups have access to which categories) is a meaningful information leak.
Recommended Fix
In objects/categories.json.php, pass the current user's ID (or 0 for unauthenticated users) instead of a boolean:
// categories.json.php — replace lines 17-24
$onlyWithVideos = false;
$sameUserGroupAsMe = false;
if(!empty($_GET['user'])){
$onlyWithVideos = true;
}
// Always apply user group filtering using the logged-in user's ID
$currentUserId = User::getId();
if (!empty($currentUserId)) {
$sameUserGroupAsMe = $currentUserId;
} else {
// For unauthenticated users, pass a value that will filter to only
// categories with no group restrictions
$sameUserGroupAsMe = -1; // Non-existent user ID, will match no groups
}
$categories = Category::getAllCategories(true, $onlyWithVideos, false, $sameUserGroupAsMe);
Additionally, in category.php:getAllCategories(), ensure the group filter block always runs when categories have group restrictions, not only when $sameUserGroupAsMe is truthy. A more robust approach:
// category.php — replace the sameUserGroupAsMe block (lines 438-452)
// Always filter by user groups if any categories have group restrictions
$users_groups_id = array(0);
if ($sameUserGroupAsMe && $sameUserGroupAsMe > 0) {
$users_groups = UserGroups::getUserGroups($sameUserGroupAsMe);
foreach ($users_groups as $value) {
$users_groups_id[] = $value['id'];
}
}
$sql .= " AND ("
. "(SELECT count(*) FROM categories_has_users_groups chug WHERE c.id = chug.categories_id) = 0 OR "
. "(SELECT count(*) FROM categories_has_users_groups chug2 WHERE c.id = chug2.categories_id AND users_groups_id IN (" . implode(',', $users_groups_id) . ")) >= 1 "
. ")";
This ensures that even when no user is logged in, categories with group restrictions are hidden (only categories with zero group restrictions are shown). The getTotalCategories() function should also be updated to accept and apply the same $sameUserGroupAsMe filter.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-34364"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-30T17:49:57Z",
"nvd_published_at": "2026-03-27T18:16:05Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `categories.json.php` endpoint, which serves the category listing API, fails to enforce user group-based access controls on categories. In the default request path (no `?user=` parameter), user group filtering is entirely skipped, exposing all non-private categories including those restricted to specific user groups. When the `?user=` parameter is supplied, a type confusion bug causes the filter to use the admin user\u0027s (user_id=1) group memberships instead of the current user\u0027s, rendering the filter ineffective.\n\n## Details\n\nThe vulnerability has two related failures in `objects/categories.json.php` and `objects/category.php`:\n\n**1. Default request \u2014 group filtering completely skipped**\n\nIn `categories.json.php:17-24`, when `$_GET[\u0027user\u0027]` is not set, `$sameUserGroupAsMe` defaults to `false`:\n\n```php\n// categories.json.php:17-24\n$onlyWithVideos = false;\n$sameUserGroupAsMe = false;\nif(!empty($_GET[\u0027user\u0027])){\n $onlyWithVideos = true;\n $sameUserGroupAsMe = true;\n}\n$categories = Category::getAllCategories(true, $onlyWithVideos, false, $sameUserGroupAsMe);\n```\n\nIn `category.php:438-452`, the user group filter is gated on `$sameUserGroupAsMe` being truthy:\n\n```php\n// category.php:438-452\nif ($sameUserGroupAsMe) {\n $users_groups = UserGroups::getUserGroups($sameUserGroupAsMe);\n $users_groups_id = array(0);\n foreach ($users_groups as $value) {\n $users_groups_id[] = $value[\u0027id\u0027];\n }\n $sql .= \" AND (\"\n . \"(SELECT count(*) FROM categories_has_users_groups chug WHERE c.id = chug.categories_id) = 0 OR \"\n . \"(SELECT count(*) FROM categories_has_users_groups chug2 WHERE c.id = chug2.categories_id AND users_groups_id IN (\" . implode(\u0027,\u0027, $users_groups_id) . \")) \u003e= 1 \"\n . \")\";\n}\n```\n\nSince `$sameUserGroupAsMe = false`, the entire block is skipped. All non-private categories are returned regardless of their user group restrictions set via the `categories_has_users_groups` table.\n\n**2. With `?user=` parameter \u2014 boolean-to-integer type confusion**\n\nWhen `$_GET[\u0027user\u0027]` is non-empty, `$sameUserGroupAsMe` is set to boolean `true` (line 21). This value is passed to `UserGroups::getUserGroups($sameUserGroupAsMe)` at `category.php:440`.\n\nIn `userGroups.php:349-379`, the parameter is used as `$users_id`:\n\n```php\n// userGroups.php:349,371,379\npublic static function getUserGroups($users_id){\n // ...\n $sql = \"SELECT uug.*, ug.* FROM users_groups ug\"\n . \" LEFT JOIN users_has_users_groups uug ON users_groups_id = ug.id WHERE users_id = ? \";\n // ...\n $res = sqlDAL::readSql($sql, \"i\", [$users_id]);\n```\n\nPHP casts boolean `true` to integer `1` for the prepared statement bind, resulting in `WHERE users_id = 1` \u2014 fetching the **admin user\u0027s** group memberships. The filter then allows categories visible to admin groups, effectively granting any unauthenticated user the admin\u0027s category visibility.\n\n**3. getTotalCategories also unfiltered**\n\n`getTotalCategories()` at `category.php:978` does not accept a `$sameUserGroupAsMe` parameter at all, so the total count always reflects the unfiltered category set.\n\nThe endpoint requires no authentication \u2014 it uses `allowOrigin()` (a CORS header helper) and is publicly routable via the `.htaccess` rewrite rule: `RewriteRule ^categories.json$ objects/categories.json.php`.\n\n## PoC\n\n```bash\n# 1. Fetch all categories without authentication \u2014 no group filtering applied\ncurl -s \u0027https://target/categories.json\u0027 | jq \u0027.rows[] | {id, name, private, users_groups_ids_array}\u0027\n\n# Returns ALL non-private categories including those restricted to specific user groups.\n# The users_groups_ids_array field reveals which groups each category is restricted to.\n# Categories with non-empty users_groups_ids_array should be hidden from users not in those groups.\n\n# 2. Attempt the \"filtered\" path \u2014 still broken due to boolean-\u003eint cast\ncurl -s \u0027https://target/categories.json?user=1\u0027 | jq \u0027.rows[] | {id, name, private, users_groups_ids_array}\u0027\n\n# This applies group filtering but uses admin\u0027s groups (users_id=1) instead of the\n# current user\u0027s groups, so group-restricted categories visible to admin are exposed.\n```\n\n## Impact\n\nAny unauthenticated user can:\n\n- **Enumerate all non-private categories** regardless of user group restrictions, bypassing the intended access control model where categories are restricted to specific user groups via the CustomizeUser plugin\u0027s `categories_has_users_groups` table.\n- **Discover the user group configuration** for each category via the `users_groups_ids_array` field in the response, revealing the internal access control structure.\n- **Identify group-restricted content areas** that should be hidden, which could be used to target further access control bypasses on the videos within those categories.\n\nThe severity is Medium because this is an information disclosure of category metadata (names, descriptions, icons, group assignments) rather than the actual video content within restricted categories. However, the exposure of the access control structure itself (which groups have access to which categories) is a meaningful information leak.\n\n## Recommended Fix\n\nIn `objects/categories.json.php`, pass the current user\u0027s ID (or 0 for unauthenticated users) instead of a boolean:\n\n```php\n// categories.json.php \u2014 replace lines 17-24\n$onlyWithVideos = false;\n$sameUserGroupAsMe = false;\nif(!empty($_GET[\u0027user\u0027])){\n $onlyWithVideos = true;\n}\n// Always apply user group filtering using the logged-in user\u0027s ID\n$currentUserId = User::getId();\nif (!empty($currentUserId)) {\n $sameUserGroupAsMe = $currentUserId;\n} else {\n // For unauthenticated users, pass a value that will filter to only\n // categories with no group restrictions\n $sameUserGroupAsMe = -1; // Non-existent user ID, will match no groups\n}\n\n$categories = Category::getAllCategories(true, $onlyWithVideos, false, $sameUserGroupAsMe);\n```\n\nAdditionally, in `category.php:getAllCategories()`, ensure the group filter block always runs when categories have group restrictions, not only when `$sameUserGroupAsMe` is truthy. A more robust approach:\n\n```php\n// category.php \u2014 replace the sameUserGroupAsMe block (lines 438-452)\n// Always filter by user groups if any categories have group restrictions\n$users_groups_id = array(0);\nif ($sameUserGroupAsMe \u0026\u0026 $sameUserGroupAsMe \u003e 0) {\n $users_groups = UserGroups::getUserGroups($sameUserGroupAsMe);\n foreach ($users_groups as $value) {\n $users_groups_id[] = $value[\u0027id\u0027];\n }\n}\n$sql .= \" AND (\"\n . \"(SELECT count(*) FROM categories_has_users_groups chug WHERE c.id = chug.categories_id) = 0 OR \"\n . \"(SELECT count(*) FROM categories_has_users_groups chug2 WHERE c.id = chug2.categories_id AND users_groups_id IN (\" . implode(\u0027,\u0027, $users_groups_id) . \")) \u003e= 1 \"\n . \")\";\n```\n\nThis ensures that even when no user is logged in, categories with group restrictions are hidden (only categories with zero group restrictions are shown). The `getTotalCategories()` function should also be updated to accept and apply the same `$sameUserGroupAsMe` filter.",
"id": "GHSA-73gr-r64q-7jh4",
"modified": "2026-03-30T17:49:57Z",
"published": "2026-03-30T17:49:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-73gr-r64q-7jh4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34364"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/6e8a673eed07be5628d0b60fbfabd171f3ce74c9"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php"
}
GHSA-73HF-2QW9-RQQM
Vulnerability from github – Published: 2022-08-24 00:00 – Updated: 2026-07-05 03:30An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.
{
"affected": [],
"aliases": [
"CVE-2022-35203"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-23T13:15:00Z",
"severity": "HIGH"
},
"details": "An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.",
"id": "GHSA-73hf-2qw9-rqqm",
"modified": "2026-07-05T03:30:50Z",
"published": "2022-08-24T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35203"
},
{
"type": "WEB",
"url": "https://medium.com/%40shrutukapoor25/cve-2022-35203-2372a0728279"
},
{
"type": "WEB",
"url": "https://medium.com/@shrutukapoor25/cve-2022-35203-2372a0728279"
},
{
"type": "WEB",
"url": "http://trendnet.com"
},
{
"type": "WEB",
"url": "http://tv-ip572pi.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-73HM-3CG9-J7HJ
Vulnerability from github – Published: 2024-05-18 15:30 – Updated: 2024-05-18 15:30MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user.
{
"affected": [],
"aliases": [
"CVE-2024-3745"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-18T13:15:49Z",
"severity": "HIGH"
},
"details": "MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-2024-1443 and CVE-2024-1460 from a low privileged user.",
"id": "GHSA-73hm-3cg9-j7hj",
"modified": "2024-05-18T15:30:37Z",
"published": "2024-05-18T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3745"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/gershwin"
},
{
"type": "WEB",
"url": "https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231456"
},
{
"type": "WEB",
"url": "https://forums.guru3d.com/threads/msi-ab-rtss-development-news-thread.412822/page-227#post-6231768"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-73Q4-J324-2QCC
Vulnerability from github – Published: 2022-02-18 00:00 – Updated: 2022-03-01 22:04The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "9.3.0"
},
{
"fixed": "9.3.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "9.2.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25270"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-01T21:39:06Z",
"nvd_published_at": "2022-02-17T00:15:00Z",
"severity": "MODERATE"
},
"details": "The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the \"access in-place editing\" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.",
"id": "GHSA-73q4-j324-2qcc",
"modified": "2022-03-01T22:04:09Z",
"published": "2022-02-18T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25270"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2022-004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incorrect authorization in Drupal core"
}
GHSA-73RP-Q4RX-5GRC
Vulnerability from github – Published: 2022-05-10 00:00 – Updated: 2022-05-24 22:00Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "microweber/microweber"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-1631"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-05-24T22:00:35Z",
"nvd_published_at": "2022-05-09T14:15:00Z",
"severity": "HIGH"
},
"details": "Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim\u2019s Email. This allows an attacker to gain pre-authentication to the victim\u2019s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker\u2019s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee\u2019s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee\u2019s account.",
"id": "GHSA-73rp-q4rx-5grc",
"modified": "2022-05-24T22:00:35Z",
"published": "2022-05-10T00:00:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1631"
},
{
"type": "WEB",
"url": "https://github.com/microweber/microweber/commit/c162dfffb9bfd264d232aaaf5bb3daee16a3cb38"
},
{
"type": "PACKAGE",
"url": "https://github.com/microweber/microweber"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/5494e258-5c7b-44b4-b443-85cff7ae0ba4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Authorization in microweber"
}
GHSA-7467-MRW5-4GPJ
Vulnerability from github – Published: 2023-05-26 18:30 – Updated: 2024-04-04 04:21The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
{
"affected": [],
"aliases": [
"CVE-2023-31226"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-26T17:15:17Z",
"severity": "HIGH"
},
"details": "The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.",
"id": "GHSA-7467-mrw5-4gpj",
"modified": "2024-04-04T04:21:11Z",
"published": "2023-05-26T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31226"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7485-8F3W-4MRF
Vulnerability from github – Published: 2024-11-28 00:39 – Updated: 2024-11-30 00:32In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2018-9374"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-28T00:15:03Z",
"severity": "HIGH"
},
"details": "In installPackageLI of PackageManagerService.java, there is a possible\u00a0permissions bypass. This could lead to local escalation of privilege with\u00a0User execution privileges needed. User interaction is not needed for\u00a0exploitation.",
"id": "GHSA-7485-8f3w-4mrf",
"modified": "2024-11-30T00:32:14Z",
"published": "2024-11-28T00:39:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9374"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/pixel/2018-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-749F-M7R4-MXQ7
Vulnerability from github – Published: 2021-12-24 00:00 – Updated: 2021-12-29 00:01Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2021-38017"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-23T01:15:00Z",
"severity": "HIGH"
},
"details": "Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.",
"id": "GHSA-749f-m7r4-mxq7",
"modified": "2021-12-29T00:01:08Z",
"published": "2021-12-24T00:00:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38017"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2021/11/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1256822"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5046"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-74F6-JP2H-2VW3
Vulnerability from github – Published: 2022-01-26 00:01 – Updated: 2022-03-26 00:01arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.
{
"affected": [],
"aliases": [
"CVE-2022-23033"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T14:15:00Z",
"severity": "HIGH"
},
"details": "arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn\u0027t have the valid bit set. It is possible to have a valid pagetable entry without the valid bit set when a guest operating system uses set/way cache maintenance instructions. For instance, a guest issuing a set/way cache maintenance instruction, then calling the XENMEM_decrease_reservation hypercall to give back memory pages to Xen, might be able to retain access to those pages even after Xen started reusing them for other purposes.",
"id": "GHSA-74f6-jp2h-2vw3",
"modified": "2022-03-26T00:01:04Z",
"published": "2022-01-26T00:01:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23033"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMR6UBGJW6JKND7IILGQ2CU35EQPF3E3"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-23"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5117"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-393.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/01/25/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.