CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18003 vulnerabilities reference this CWE, most recent first.
GHSA-R9M5-FCW8-68F6
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks proper access control, such as middleware to ensure that only authorized users (e.g., project owners or admins) can modify checklist data. This vulnerability allows any user associated with the project, regardless of their role, to modify checklists, including changing the slug or data fields, which can lead to tampering with essential project workflows, altering business logic, and introducing errors that undermine integrity.
{
"affected": [],
"aliases": [
"CVE-2024-9096"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:46Z",
"severity": "HIGH"
},
"details": "In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks proper access control, such as middleware to ensure that only authorized users (e.g., project owners or admins) can modify checklist data. This vulnerability allows any user associated with the project, regardless of their role, to modify checklists, including changing the slug or data fields, which can lead to tampering with essential project workflows, altering business logic, and introducing errors that undermine integrity.",
"id": "GHSA-r9m5-fcw8-68f6",
"modified": "2025-03-20T12:32:50Z",
"published": "2025-03-20T12:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9096"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/a8d7b2959e87c30fbafdb12af7ffa093385dcc60"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/653e7109-4c21-4e33-b636-7598d3202b9a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R9M6-M627-3WFV
Vulnerability from github – Published: 2024-10-08 12:30 – Updated: 2024-10-08 12:30The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.
{
"affected": [],
"aliases": [
"CVE-2024-8431"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-08T12:15:02Z",
"severity": "MODERATE"
},
"details": "The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.",
"id": "GHSA-r9m6-m627-3wfv",
"modified": "2024-10-08T12:30:22Z",
"published": "2024-10-08T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8431"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.21/includes/extensions/block/src/init.php#L105"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3162670/robo-gallery/trunk/includes/extensions/block/src/init.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R9PC-M5V5-X22J
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-06-19 15:30Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.
{
"affected": [],
"aliases": [
"CVE-2023-39990"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T13:15:54Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 1.2.3.",
"id": "GHSA-r9pc-m5v5-x22j",
"modified": "2024-06-19T15:30:52Z",
"published": "2024-06-19T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39990"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/pmpro-courses/wordpress-paid-memberships-pro-courses-for-membership-add-on-plugin-1-2-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R9PH-3637-55PX
Vulnerability from github – Published: 2026-10-07 18:02 – Updated: 2026-10-07 18:02Impact
An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters.
Patches
Patched in @backstage/plugin-kubernetes-backend version 0.21.8.
Workarounds
- Disable the deprecated
/services/:serviceIdroute by deploying a custom Kubernetes router that omits it. - Restrict access to the
kubernetes.resources.readpermission to limit the set of users who can reach the endpoint.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-kubernetes-backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-106563"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T18:02:37Z",
"nvd_published_at": "2026-10-07T15:17:17Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nAn authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters.\n\n### Patches\n\nPatched in `@backstage/plugin-kubernetes-backend` version 0.21.8.\n\n### Workarounds\n\n- Disable the deprecated `/services/:serviceId` route by deploying a custom Kubernetes router that omits it.\n- Restrict access to the `kubernetes.resources.read` permission to limit the set of users who can reach the endpoint.",
"id": "GHSA-r9ph-3637-55px",
"modified": "2026-10-07T18:02:37Z",
"published": "2026-10-07T18:02:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-r9ph-3637-55px"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106563"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/commit/2d5d3e77d630455d6d48cfa8f31fd3c126fd6f29"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
},
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/releases/tag/v1.54.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Backstage: Improper entity validation in deprecated Kubernetes services endpoint"
}
GHSA-R9R3-G9FP-3Q4Q
Vulnerability from github – Published: 2026-08-19 19:32 – Updated: 2026-08-19 19:32Impact
Any activated account in a company can read every maintenance record for that company (asset tag, supplier, purchase cost, free-text notes, dates) without holding any asset or maintenance permission.
Summary
MaintenancesController::show() renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; show() does not. Any user in the asset's company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting /maintenances/{id}, regardless of permissions.
Details
public function show(Maintenance $maintenance): View|RedirectResponse
{
return view('maintenances.view')->with('maintenance', $maintenance);
}
No authorize() call. The sibling actions all gate on the asset: index() calls authorize('view', Asset::class) (line 33), and edit()/update()/destroy() call authorize('update', $maintenance->asset) (lines 139, 166, 286). The route is registered with only the auth guard:
Route::resource('maintenances', MaintenancesController::class, ['middleware' => ['auth']]);
(routes/web/hardware.php:185). Route-model binding still applies the company scope, so the read is bounded to the caller's company; the absent permission gate is the defect. Maintenance IDs are sequential and visible in the record URL.
Proof of concept
- As an administrator, create an asset in a company (here,
CompanyA). Open the asset, choose Maintenances > Create, and add a record: nameMntA2, supplierSupA, a purchase cost, and notes. The saved record opens at/maintenances/{id}. - As the administrator, create a test user assigned to CompanyA, with every permission left unchecked. Activate the account.
- In a separate browser session, log in as the test user. Confirm it is unprivileged: the Assets and Maintenances navigation items are absent, and browsing to
/hardwarereturns 403. - In the address bar, browse to
http://<host>/maintenances/{id}.
Observed: the maintenance view renders in full for the unprivileged account.
GET /maintenances/5 -> HTTP 200 OK
Renders the "Maintenance" detail page for MntA2:
Asset: AssetA Supplier: SupA Cost: <value> Notes: <text> Dates: <...>
GET /hardware -> HTTP 403 (same account, asset list is gated)
GET /maintenances -> HTTP 403 (same account, maintenance list is gated)
GET /maintenances/2 -> HTTP 302 (record in CompanyB; company scope still hides it)
- The
testaccount holds zero permissions and still reads the record. - Only the unguarded
showroute leaks: the list view and the asset pages return 403 for the same account. - A maintenance in a different company (CompanyB) redirects away, confirming the FMCS company scope still holds.
Patches
Patched in https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55703"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-19T19:32:25Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nAny activated account in a company can read every maintenance record for that company (asset tag, supplier, purchase cost, free-text notes, dates) without holding any asset or maintenance permission.\n\n## Summary\n\n`MaintenancesController::show()` renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; `show()` does not. Any user in the asset\u0027s company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting `/maintenances/{id}`, regardless of permissions.\n\n## Details\n\n```php\npublic function show(Maintenance $maintenance): View|RedirectResponse\n{\n return view(\u0027maintenances.view\u0027)-\u003ewith(\u0027maintenance\u0027, $maintenance);\n}\n```\n\nNo `authorize()` call. The sibling actions all gate on the asset: `index()` calls `authorize(\u0027view\u0027, Asset::class)` (line 33), and `edit()`/`update()`/`destroy()` call `authorize(\u0027update\u0027, $maintenance-\u003easset)` (lines 139, 166, 286). The route is registered with only the auth guard:\n\n```php\nRoute::resource(\u0027maintenances\u0027, MaintenancesController::class, [\u0027middleware\u0027 =\u003e [\u0027auth\u0027]]);\n```\n\n(`routes/web/hardware.php:185`). Route-model binding still applies the company scope, so the read is bounded to the caller\u0027s company; the absent permission gate is the defect. Maintenance IDs are sequential and visible in the record URL.\n\n## Proof of concept\n\n1. As an administrator, create an asset in a company (here, `CompanyA`). Open the asset, choose Maintenances \u003e Create, and add a record: name `MntA2`, supplier `SupA`, a purchase cost, and notes. The saved record opens at `/maintenances/{id}`.\n2. As the administrator, create a test user assigned to CompanyA, with **every permission left unchecked**. Activate the account.\n3. In a separate browser session, log in as the test user. Confirm it is unprivileged: the Assets and Maintenances navigation items are absent, and browsing to `/hardware` returns 403.\n4. In the address bar, browse to `http://\u003chost\u003e/maintenances/{id}`.\n\nObserved: the maintenance view renders in full for the unprivileged account.\n\n```\nGET /maintenances/5 -\u003e HTTP 200 OK\nRenders the \"Maintenance\" detail page for MntA2:\n Asset: AssetA Supplier: SupA Cost: \u003cvalue\u003e Notes: \u003ctext\u003e Dates: \u003c...\u003e\n\nGET /hardware -\u003e HTTP 403 (same account, asset list is gated)\nGET /maintenances -\u003e HTTP 403 (same account, maintenance list is gated)\nGET /maintenances/2 -\u003e HTTP 302 (record in CompanyB; company scope still hides it)\n```\n\n- The `test` account holds zero permissions and still reads the record.\n- Only the unguarded `show` route leaks: the list view and the asset pages return 403 for the same account.\n- A maintenance in a different company (CompanyB) redirects away, confirming the FMCS company scope still holds.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96",
"id": "GHSA-r9r3-g9fp-3q4q",
"modified": "2026-08-19T19:32:25Z",
"published": "2026-08-19T19:32:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET"
}
GHSA-R9R4-X4GJ-8846
Vulnerability from github – Published: 2024-06-07 03:31 – Updated: 2024-06-07 03:31The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.
{
"affected": [],
"aliases": [
"CVE-2024-1689"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-07T02:15:09Z",
"severity": "MODERATE"
},
"details": "The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommerce_tool_toggle_module() function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to deactivate arbitrary plugin modules.",
"id": "GHSA-r9r4-x4gj-8846",
"modified": "2024-06-07T03:31:07Z",
"published": "2024-06-07T03:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1689"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/woo-tools/trunk/admin/admin-init.php#L61"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3098165%40woo-tools\u0026new=3098165%40woo-tools\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3830c901-be36-4c4b-976b-d388b6af0c67?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R9V2-GG2J-22Q5
Vulnerability from github – Published: 2026-10-06 16:09 – Updated: 2026-10-06 16:09Impact
An authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.
You are affected if ALL of these are true:
- Your application uses
@payloadcms/plugin-stripe. - The optional Stripe REST proxy is enabled.
- An authenticated user can reach the proxy.
Deployments that do not enable the Stripe REST proxy are not affected.
Patches
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Workarounds
Upgrading to a patched version is recommended.
If you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@payloadcms/plugin-stripe"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.90.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@payloadcms/plugin-stripe"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-canary.0"
},
{
"fixed": "4.0.0-canary.34"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-105848"
],
"database_specific": {
"cwe_ids": [
"CWE-749",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-06T16:09:46Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\n\nAn authenticated user could perform unintended Stripe operations through the optional Stripe REST proxy.\n\n**You are affected if ALL of these are true:**\n\n- Your application uses `@payloadcms/plugin-stripe`.\n- The optional Stripe REST proxy is enabled.\n- An authenticated user can reach the proxy.\n\nDeployments that do not enable the Stripe REST proxy are not affected.\n\n## Patches\n\nUsers should upgrade Payload packages to `\u003e= 3.90.0` or `\u003e= 4.0.0-canary.34`.\n\n## Workarounds\n\nUpgrading to a patched version is recommended. \n\nIf you cannot upgrade immediately, disable the Stripe REST proxy. If it must remain enabled, restrict access to trusted users and only the required Stripe operations.",
"id": "GHSA-r9v2-gg2j-22q5",
"modified": "2026-10-06T16:09:47Z",
"published": "2026-10-06T16:09:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-r9v2-gg2j-22q5"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/commit/2f94a4205e5ba3ec0e91c92ed54f24f429826dd0"
},
{
"type": "PACKAGE",
"url": "https://github.com/payloadcms/payload"
},
{
"type": "WEB",
"url": "https://github.com/payloadcms/payload/releases/tag/v3.90.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Payload: Insufficient Access Control in Stripe REST Proxy"
}
GHSA-R9VG-QVPJ-R6FQ
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.
{
"affected": [],
"aliases": [
"CVE-2025-67588"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:18:36Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through \u003c= 3.33.0.",
"id": "GHSA-r9vg-qvpj-r6fq",
"modified": "2026-01-20T15:32:12Z",
"published": "2025-12-09T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67588"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-33-0-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/elementor/vulnerability/wordpress-elementor-website-builder-plugin-3-33-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R9VJ-M6Q6-FGW4
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-12 15:30The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access and above, to view private notes via recent comments that should be restricted to just administrators.
{
"affected": [],
"aliases": [
"CVE-2024-7648"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:48Z",
"severity": "MODERATE"
},
"details": "The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access and above, to view private notes via recent comments that should be restricted to just administrators.",
"id": "GHSA-r9vj-m6q6-fgw4",
"modified": "2024-08-12T15:30:53Z",
"published": "2024-08-12T15:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7648"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/opal-membership/trunk/inc/class-opalmembership-ajax.php#L128"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/opal-membership/trunk/inc/mixes-functions.php#L154"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d3098565-d037-4a31-af3c-00e8b93b922e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R9X9-FWPC-8MMV
Vulnerability from github – Published: 2024-03-11 18:31 – Updated: 2024-11-21 21:33In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-0052"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-11T17:15:45Z",
"severity": "LOW"
},
"details": "In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-r9x9-fwpc-8mmv",
"modified": "2024-11-21T21:33:30Z",
"published": "2024-03-11T18:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0052"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/modules/HealthFitness/+/178f4824574fdf33ed4ac584d092240d1c771b04"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.