CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18003 vulnerabilities reference this CWE, most recent first.
GHSA-MF42-3C8Q-X7X8
Vulnerability from github – Published: 2026-07-20 12:33 – Updated: 2026-09-04 20:18Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references.
Original Description
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.1.0"
},
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-04T20:18:26Z",
"nvd_published_at": "2026-07-20T12:19:45Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references.\n\n## Original Description\nSurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users\u0027 LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.",
"id": "GHSA-mf42-3c8q-x7x8",
"modified": "2026-09-04T20:18:26Z",
"published": "2026-07-20T12:33:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gcwr-5mrf-fvch"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63758"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-kill-statement"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users\u0027 Live Queries",
"withdrawn": "2026-09-04T20:18:26Z"
}
GHSA-MF42-3PGF-R88C
Vulnerability from github – Published: 2026-01-28 12:30 – Updated: 2026-01-28 12:30The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the 'nonce_token' authentication value to log in to the first Administrator's account.
{
"affected": [],
"aliases": [
"CVE-2025-14386"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-28T12:15:49Z",
"severity": "HIGH"
},
"details": "The Search Atlas SEO \u2013 Premier SEO Plugin for One-Click WP Publishing \u0026 Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the \u0027generate_sso_url\u0027 and \u0027validate_sso_token\u0027 functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the \u0027nonce_token\u0027 authentication value to log in to the first Administrator\u0027s account.",
"id": "GHSA-mf42-3pgf-r88c",
"modified": "2026-01-28T12:30:28Z",
"published": "2026-01-28T12:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14386"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1042"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L1141"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/metasync/tags/2.5.12/admin/class-metasync-admin.php#L851"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f63d2c4-cbae-4177-8494-daca96449ecc?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MF55-CGJW-RPG2
Vulnerability from github – Published: 2026-07-23 12:32 – Updated: 2026-07-23 12:32Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
{
"affected": [],
"aliases": [
"CVE-2026-65469"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-23T12:18:39Z",
"severity": "MODERATE"
},
"details": "Unauthenticated Broken Access Control in AWP Classifieds \u003c= 4.4.7 versions.",
"id": "GHSA-mf55-cgjw-rpg2",
"modified": "2026-07-23T12:32:28Z",
"published": "2026-07-23T12:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65469"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/another-wordpress-classifieds-plugin/vulnerability/wordpress-awp-classifieds-plugin-4-4-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MF5H-78MJ-WJX6
Vulnerability from github – Published: 2023-03-10 21:30 – Updated: 2023-03-15 18:30In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
{
"affected": [],
"aliases": [
"CVE-2022-47478"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-10T21:15:00Z",
"severity": "MODERATE"
},
"details": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.",
"id": "GHSA-mf5h-78mj-wjx6",
"modified": "2023-03-15T18:30:25Z",
"published": "2023-03-10T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-47478"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1632612109718192129"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MF5R-54HH-G48Q
Vulnerability from github – Published: 2026-10-11 15:31 – Updated: 2026-10-11 15:31JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and query each id to obtain system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings of other users' applications.
{
"affected": [],
"aliases": [
"CVE-2026-108878"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-11T15:16:54Z",
"severity": "MODERATE"
},
"details": "JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privileged authenticated users to read any AI application configuration. Attackers can enumerate application ids via the unguarded /airag/app/listDict endpoint and query each id to obtain system prompts, memory prompts, model ids, knowledge base ids, and plugin bindings of other users\u0027 applications.",
"id": "GHSA-mf5r-54hh-g48q",
"modified": "2026-10-11T15:31:10Z",
"published": "2026-10-11T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108878"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_airag_app_query_by_id.py"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/app/controller/AiragAppController.java#L196-L203"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-airag-app-querybyid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MF65-6R53-94V7
Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-11 21:31Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
{
"affected": [],
"aliases": [
"CVE-2026-62135"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-11T19:17:44Z",
"severity": "MODERATE"
},
"details": "Unauthenticated Broken Access Control in Booktics \u003c= 1.0.24 versions.",
"id": "GHSA-mf65-6r53-94v7",
"modified": "2026-09-11T21:31:18Z",
"published": "2026-09-11T21:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62135"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-24-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MF6V-FWP6-46G3
Vulnerability from github – Published: 2026-07-28 18:33 – Updated: 2026-07-28 18:33Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.
{
"affected": [],
"aliases": [
"CVE-2026-66750"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T16:20:16Z",
"severity": "MODERATE"
},
"details": "Let\u0027s Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.",
"id": "GHSA-mf6v-fwp6-46g3",
"modified": "2026-07-28T18:33:03Z",
"published": "2026-07-28T18:33:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66750"
},
{
"type": "WEB",
"url": "https://github.com/theopaid/Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/let-s-chat-broken-access-control-file-disclosure-via-get-files-route"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MF78-3RPF-R784
Vulnerability from github – Published: 2026-07-14 20:19 – Updated: 2026-07-14 20:19Summary
Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., csv_reader, log_reader). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., /etc/passwd, ~/.ssh/id_rsa). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.
Details
Anyquery utilizes the hashicorp/go-getter library within its data ingestion modules. When Anyquery is launched in Server Mode (anyquery server), it binds to a TCP port and accepts MySQL protocol connections. The server handler does not restrict the usage of these virtual table modules to safe directories. An attacker can connect to the server and execute native SQLite virtual table creation queries to instantiate modules like csv_reader pointing to restricted files. Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has access to.
PoC (Proof of Concept)
- Start the server on the victim machine:
bash anyquery server --host 0.0.0.0 --port 8070 - Connect from an attacker machine:
bash mysql -u root -h <VICTIM_IP> -P 8070 - Execute the following payload to read
/etc/passwd:sql CREATE VIRTUAL TABLE passwd USING csv_reader('/etc/passwd'); SELECT * FROM passwd;
Impact
- Confidentiality: High. Complete compromise of local file system confidentiality.
- Integrity: None.
- Availability: None.
- CVSS Score: 7.5 (High) -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remediation
Implement a sandboxing mechanism in Server Mode (e.g., a --restrict-paths flag) to limit read_* operations to designated directories.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 0.4.5"
},
"package": {
"ecosystem": "Go",
"name": "github.com/julien040/anyquery"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54629"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-284",
"CWE-552",
"CWE-73",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-14T20:19:07Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nAnyquery\u0027s `server` mode lacks input sanitization and access control over its built-in SQLite virtual table modules (e.g., `csv_reader`, `log_reader`). Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). This allows full Local File Read (LFR) capabilities, compromising sensitive system configurations and credentials.\n\n## Details\nAnyquery utilizes the `hashicorp/go-getter` library within its data ingestion modules. When Anyquery is launched in **Server Mode** (`anyquery server`), it binds to a TCP port and accepts MySQL protocol connections. The server handler does not restrict the usage of these virtual table modules to safe directories. An attacker can connect to the server and execute native SQLite virtual table creation queries to instantiate modules like `csv_reader` pointing to restricted files. Because the file read operation is initiated by the Anyquery server process, the attacker can read any file the process has access to.\n\n## PoC (Proof of Concept)\n1. Start the server on the victim machine:\n ```bash\n anyquery server --host 0.0.0.0 --port 8070\n ```\n2. Connect from an attacker machine:\n ```bash\n mysql -u root -h \u003cVICTIM_IP\u003e -P 8070\n ```\n3. Execute the following payload to read `/etc/passwd`:\n ```sql\n CREATE VIRTUAL TABLE passwd USING csv_reader(\u0027/etc/passwd\u0027);\n SELECT * FROM passwd;\n ```\n\n## Impact\n- **Confidentiality:** High. Complete compromise of local file system confidentiality.\n- **Integrity:** None.\n- **Availability:** None.\n- **CVSS Score:** 7.5 (High) - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`\n\n## Remediation\nImplement a sandboxing mechanism in Server Mode (e.g., a `--restrict-paths` flag) to limit `read_*` operations to designated directories.",
"id": "GHSA-mf78-3rpf-r784",
"modified": "2026-07-14T20:19:07Z",
"published": "2026-07-14T20:19:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784"
},
{
"type": "PACKAGE",
"url": "https://github.com/julien040/anyquery"
},
{
"type": "WEB",
"url": "https://github.com/julien040/anyquery/releases/tag/0.4.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode"
}
GHSA-MF98-5JRC-H8CV
Vulnerability from github – Published: 2025-08-14 18:31 – Updated: 2025-08-14 18:31A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain.
This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a generated report file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to access a previously run report for a different domain, which could allow an attacker to read activity recorded in that domain.
{
"affected": [],
"aliases": [
"CVE-2025-20302"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-14T17:15:40Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain.\n\nThis vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a generated report file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to access a previously run report for a different domain, which could allow an attacker to read activity recorded in that domain.",
"id": "GHSA-mf98-5jrc-h8cv",
"modified": "2025-08-14T18:31:30Z",
"published": "2025-08-14T18:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20302"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-authz-bypass-M7xhnAu"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFC4-5W6J-R334
Vulnerability from github – Published: 2024-01-17 18:31 – Updated: 2026-04-28 21:33Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.
{
"affected": [],
"aliases": [
"CVE-2022-36418"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-17T16:15:45Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0.",
"id": "GHSA-mfc4-5w6j-r334",
"modified": "2026-04-28T21:33:48Z",
"published": "2024-01-17T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36418"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/hreflang-tags-by-dcgws/wordpress-hreflang-tags-lite-plugin-2-0-0-unauthenticated-plugin-data-reset-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.