CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7172 vulnerabilities reference this CWE, most recent first.
GHSA-C487-GPMP-P2V9
Vulnerability from github – Published: 2023-12-05 00:31 – Updated: 2024-08-01 15:31An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashing algorithm.
{
"affected": [],
"aliases": [
"CVE-2023-24047"
],
"database_specific": {
"cwe_ids": [
"CWE-522",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-04T23:15:23Z",
"severity": "MODERATE"
},
"details": "An Insecure Credential Management issue discovered in Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges via use of weak hashing algorithm.",
"id": "GHSA-c487-gpmp-p2v9",
"modified": "2024-08-01T15:31:25Z",
"published": "2023-12-05T00:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24047"
},
{
"type": "WEB",
"url": "https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulnerabilities-in-connectize-g6-ac2100-dual-band-gigabit-wifi-router-cve-2023-24046-cve-2023-24047-cve-2023-24048-cve-2023-24049-cve-2023-24050-cve-2023-24051-cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C48M-32M9-VX93
Vulnerability from github – Published: 2026-10-01 15:37 – Updated: 2026-10-01 15:37Summary
vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.
When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permits left-pad, an attacker can still bypass the check with a colliding package name such as evil-left-pad, because it contains the allowlisted name.
If the colliding package already exists in a host path resolvable by the custom resolver, or if the target application's custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution.
Details
NodeVM supports require.external to configure which external npm packages sandboxed code may load. It also supports a custom resolver through require.resolve. This combination is commonly used in business plugin systems, user-script platforms, or sandbox execution environments: the application allows only a small set of trusted dependencies while using a custom resolver that points to the application's own package directory.
The vulnerability is in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the external allowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, so it performs a substring match on the original package name.
For example, with the following configuration:
new NodeVM({
require: {
external: ['left-pad'],
resolve: id => require.resolve(id, { paths: [customRoot] }),
context: 'host',
builtin: []
}
})
The intended policy is that sandboxed code can only load left-pad. However, because vm2 uses a non-exact match similar to /left\-pad/ for the requested package name, names such as evil-left-pad and left-pad-backdoor also pass the allowlist pre-check.
After evil-left-pad passes the check, vm2 calls the custom resolver configured by the application. If the resolver can find that colliding package in a host-resolvable path, vm2 adds the returned path to the loadable list and, in context: 'host' mode, loads the package with the host require(). At that point, the package's top-level code executes in the host context instead of being constrained by sandbox restrictions such as NodeVM's builtin: [].
In local verification, the PoC only allows external: ['left-pad'] and sets builtin: [], so sandboxed code cannot directly load child_process. However, after the sandboxed code executes require('evil-left-pad'), vm2 still loads the colliding package from a host path. The colliding package's top-level code successfully invokes the host child_process module and prints HOST_EXEC.
This issue does not mean that vm2 automatically downloads malicious packages from npm at runtime. The attack requires the colliding package to already be in a path resolvable by the custom resolver, or for the target application's own dependency resolution / download workflow to place that package in such a path. This precondition limits the affected scenarios, but it does not change the core vulnerability: the external allowlist is not enforced against complete package-name boundaries, allowing sandboxed code to load a host package that the application did not authorize.
PoC
An independent PoC is attached in the poc directory. The PoC installs vm2 3.11.5, creates a temporary host package directory, and writes an unauthorized evil-left-pad package into it.
Run the following from the poc directory:
npm install
node poc.js
When the vulnerability is present, the output is similar to:
[+] vm2 version: 3.11.5
[+] customRoot: /tmp/vm2-resolver-poc-xxxxxx/custom
[+] Direct sandbox require("child_process") is blocked: ENOTFOUND
[+] Unrelated package is blocked: ENOTFOUND
[+] require("evil-left-pad") result: HOST_EXEC
[+] RESULT: VULNERABLE
HOST_EXEC is produced by the top-level code of the evil-left-pad package through host-side child_process.execFileSync(), demonstrating that the unauthorized package has executed in the host context.
Expected result: when the external allowlist only contains left-pad, evil-left-pad should be rejected.
Actual result: evil-left-pad passes the check because it contains the left-pad substring and then executes in the host context.
Impact
Under the affected configuration, an attacker can load a colliding host package that is not allowed by the external allowlist through sandboxed code, breaking NodeVM's module access control.
If the attacker can control or influence the contents of the colliding package, for example by placing a malicious package through a plugin upload directory, a user-controllable dependency directory, a private registry synchronization directory, an application-specific dependency download workflow, or another path reachable by the resolver, the attacker can further execute code in the host Node.js process context. The attacker may read files, environment variables, and secrets accessible to the host process, modify host-writable data, or interrupt the host service.
The main exploitation prerequisites are:
- The application uses vm2
NodeVMto execute untrusted or low-trust JavaScript code. - The application enables a
require.externalallowlist instead of allowing all external packages. - The application configures a custom
require.resolve. - The colliding package already exists in a path resolvable by that custom resolver, or the application's workflow downloads / synchronizes it into that path.
- The application loads external packages in the host context, or keeps the relevant default behavior.
If the deployed custom resolver only searches a fixed dependency directory that is fully trusted and cannot be influenced by an attacker, practical exploitability is reduced. However, in scenarios such as plugin systems, user scripts, uploadable dependency packages, private package-source synchronization, or multi-tenant sandbox platforms, this vulnerability can bypass the sandbox boundary.
Credit
This vulnerability was discovered by:
- XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)
- Atuin Automated Vulnerability Discovery Engine
- Guannan Wang (wgnbuaa@gmail.com), Zhanpeng Liu (pkugenuine@gmail.com), Jiashuo Liang (761232680@qq.com), Guancheng Li (lgcpku@gmail.com)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.11.6"
},
"package": {
"ecosystem": "npm",
"name": "vm2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-92951"
],
"database_specific": {
"cwe_ids": [
"CWE-706",
"CWE-829",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-01T15:37:19Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\n\nvm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.\n\nWhen `NodeVM` enables an `external` allowlist together with a custom `resolve` callback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permits `left-pad`, an attacker can still bypass the check with a colliding package name such as `evil-left-pad`, because it contains the allowlisted name.\n\nIf the colliding package already exists in a host path resolvable by the custom resolver, or if the target application\u0027s custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution.\n\n### Details\n\n`NodeVM` supports `require.external` to configure which external npm packages sandboxed code may load. It also supports a custom resolver through `require.resolve`. This combination is commonly used in business plugin systems, user-script platforms, or sandbox execution environments: the application allows only a small set of trusted dependencies while using a custom resolver that points to the application\u0027s own package directory.\n\nThe vulnerability is in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the `external` allowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, so it performs a substring match on the original package name.\n\nFor example, with the following configuration:\n\n```js\nnew NodeVM({\n require: {\n external: [\u0027left-pad\u0027],\n resolve: id =\u003e require.resolve(id, { paths: [customRoot] }),\n context: \u0027host\u0027,\n builtin: []\n }\n})\n```\n\nThe intended policy is that sandboxed code can only load `left-pad`. However, because vm2 uses a non-exact match similar to `/left\\-pad/` for the requested package name, names such as `evil-left-pad` and `left-pad-backdoor` also pass the allowlist pre-check.\n\nAfter `evil-left-pad` passes the check, vm2 calls the custom resolver configured by the application. If the resolver can find that colliding package in a host-resolvable path, vm2 adds the returned path to the loadable list and, in `context: \u0027host\u0027` mode, loads the package with the host `require()`. At that point, the package\u0027s top-level code executes in the host context instead of being constrained by sandbox restrictions such as `NodeVM`\u0027s `builtin: []`.\n\nIn local verification, the PoC only allows `external: [\u0027left-pad\u0027]` and sets `builtin: []`, so sandboxed code cannot directly load `child_process`. However, after the sandboxed code executes `require(\u0027evil-left-pad\u0027)`, vm2 still loads the colliding package from a host path. The colliding package\u0027s top-level code successfully invokes the host `child_process` module and prints `HOST_EXEC`.\n\nThis issue does not mean that vm2 automatically downloads malicious packages from npm at runtime. The attack requires the colliding package to already be in a path resolvable by the custom resolver, or for the target application\u0027s own dependency resolution / download workflow to place that package in such a path. This precondition limits the affected scenarios, but it does not change the core vulnerability: the `external` allowlist is not enforced against complete package-name boundaries, allowing sandboxed code to load a host package that the application did not authorize.\n\n### PoC\n\nAn independent PoC is attached in the `poc` directory. The PoC installs vm2 `3.11.5`, creates a temporary host package directory, and writes an unauthorized `evil-left-pad` package into it.\n\nRun the following from the `poc` directory:\n\n```bash\nnpm install\nnode poc.js\n```\n\nWhen the vulnerability is present, the output is similar to:\n\n```text\n[+] vm2 version: 3.11.5\n[+] customRoot: /tmp/vm2-resolver-poc-xxxxxx/custom\n[+] Direct sandbox require(\"child_process\") is blocked: ENOTFOUND\n[+] Unrelated package is blocked: ENOTFOUND\n[+] require(\"evil-left-pad\") result: HOST_EXEC\n[+] RESULT: VULNERABLE\n```\n\n`HOST_EXEC` is produced by the top-level code of the `evil-left-pad` package through host-side `child_process.execFileSync()`, demonstrating that the unauthorized package has executed in the host context.\n\nExpected result: when the `external` allowlist only contains `left-pad`, `evil-left-pad` should be rejected.\n\nActual result: `evil-left-pad` passes the check because it contains the `left-pad` substring and then executes in the host context.\n\n### Impact\n\nUnder the affected configuration, an attacker can load a colliding host package that is not allowed by the `external` allowlist through sandboxed code, breaking `NodeVM`\u0027s module access control.\n\nIf the attacker can control or influence the contents of the colliding package, for example by placing a malicious package through a plugin upload directory, a user-controllable dependency directory, a private registry synchronization directory, an application-specific dependency download workflow, or another path reachable by the resolver, the attacker can further execute code in the host Node.js process context. The attacker may read files, environment variables, and secrets accessible to the host process, modify host-writable data, or interrupt the host service.\n\nThe main exploitation prerequisites are:\n\n- The application uses vm2 `NodeVM` to execute untrusted or low-trust JavaScript code.\n- The application enables a `require.external` allowlist instead of allowing all external packages.\n- The application configures a custom `require.resolve`.\n- The colliding package already exists in a path resolvable by that custom resolver, or the application\u0027s workflow downloads / synchronizes it into that path.\n- The application loads external packages in the host context, or keeps the relevant default behavior.\n\nIf the deployed custom resolver only searches a fixed dependency directory that is fully trusted and cannot be influenced by an attacker, practical exploitability is reduced. However, in scenarios such as plugin systems, user scripts, uploadable dependency packages, private package-source synchronization, or multi-tenant sandbox platforms, this vulnerability can bypass the sandbox boundary.\n\n### Credit\n\nThis vulnerability was discovered by:\n\n- XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)\n- Atuin Automated Vulnerability Discovery Engine\n- Guannan Wang (wgnbuaa@gmail.com), Zhanpeng Liu (pkugenuine@gmail.com), Jiashuo Liang (761232680@qq.com), Guancheng Li (lgcpku@gmail.com)",
"id": "GHSA-c48m-32m9-vx93",
"modified": "2026-10-01T15:37:19Z",
"published": "2026-10-01T15:37:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92951"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa9c"
},
{
"type": "PACKAGE",
"url": "https://github.com/patriksimek/vm2"
},
{
"type": "WEB",
"url": "https://github.com/patriksimek/vm2/releases/tag/v3.11.7"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package"
}
GHSA-C4JR-H3RC-C3HG
Vulnerability from github – Published: 2026-09-02 12:31 – Updated: 2026-09-02 12:31Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
{
"affected": [],
"aliases": [
"CVE-2026-84808"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T12:17:17Z",
"severity": "MODERATE"
},
"details": "Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.",
"id": "GHSA-c4jr-h3rc-c3hg",
"modified": "2026-09-02T12:31:32Z",
"published": "2026-09-02T12:31:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kimai/kimai/security/advisories/GHSA-c6j4-35fc-x3hw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84808"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/kimai-before-2.65.0-authorization-bypass-via-api-timesheet"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-C4M9-C23M-M88F
Vulnerability from github – Published: 2023-07-06 21:15 – Updated: 2024-04-04 05:48SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality of arbitrary electronic locks.
{
"affected": [],
"aliases": [
"CVE-2022-46307"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-02T11:15:09Z",
"severity": "HIGH"
},
"details": "SGUDA U-Lock central lock control service\u2019s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality of arbitrary electronic locks.",
"id": "GHSA-c4m9-c23m-m88f",
"modified": "2024-04-04T05:48:48Z",
"published": "2023-07-06T21:15:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46307"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7099-e8897-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C4P6-QG4M-9JMR
Vulnerability from github – Published: 2025-12-22 20:08 – Updated: 2025-12-23 16:01Impact
An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.
The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.
An attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node's filesystem (where the KEDA pod resides) by directing the file's content to a server under their control, as part of the Vault authentication request.
The potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.
Patches
The problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.
Workarounds
The only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.
Only trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.
This limits an attacker's ability to configure a malicious TriggerAuthentication with an arbitrary path.
Is my project affected?
If it execute s
kubectl get deploy keda-operator -n keda -o jsonpath="{.spec.template.spec.containers[0].image}"
and the version is not 2.17.3, 2.18.3 or >= 2.19.0, that version is affected.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/kedacore/keda/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.18.0"
},
{
"fixed": "2.18.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/kedacore/keda/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.17.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-68476"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-22T20:08:24Z",
"nvd_published_at": "2025-12-22T22:16:09Z",
"severity": "HIGH"
},
"details": "### Impact\nAn Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication.\n\nThe vulnerability stems from an incorrect or insufficient path validation when loading the Service Account Token specified in spec.hashiCorpVault.credential.serviceAccount.\n\nAn attacker with permissions to create or modify a TriggerAuthentication resource can exfiltrate the content of any file from the node\u0027s filesystem (where the KEDA pod resides) by directing the file\u0027s content to a server under their control, as part of the Vault authentication request.\n\nThe potential impact includes the exfiltration of sensitive system information, such as secrets, keys, or the content of files like /etc/passwd.\n\n### Patches\nThe problem has been patched in v2.17.3 and 2.18.3 as well as in main branch.\n\n### Workarounds\nThe only effective workaround is the strict restriction of permissions for creating and modifying TriggerAuthentication resources within the Kubernetes cluster.\n\nOnly trusted and authorized users should have create or update permissions on the TriggerAuthentication resource.\n\nThis limits an attacker\u0027s ability to configure a malicious TriggerAuthentication with an arbitrary path.\n\n### Is my project affected?\nIf it execute s\n```bash\nkubectl get deploy keda-operator -n keda -o jsonpath=\"{.spec.template.spec.containers[0].image}\"\n```\nand the version is not 2.17.3, 2.18.3 or \u003e= 2.19.0, that version is affected.",
"id": "GHSA-c4p6-qg4m-9jmr",
"modified": "2025-12-23T16:01:17Z",
"published": "2025-12-22T20:08:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kedacore/keda/security/advisories/GHSA-c4p6-qg4m-9jmr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68476"
},
{
"type": "WEB",
"url": "https://github.com/kedacore/keda/commit/15c5677f65f809b9b6b59a52f4cf793db0a510fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/kedacore/keda"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential"
}
GHSA-C4PP-F6G5-6WX8
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-05-24 19:15Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure.
{
"affected": [],
"aliases": [
"CVE-2021-22535"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-28T14:15:00Z",
"severity": "MODERATE"
},
"details": "Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all DRA versions prior to 10.1 Patch 1. The vulnerability could lead to unauthorized information disclosure.",
"id": "GHSA-c4pp-f6g5-6wx8",
"modified": "2022-05-24T19:15:59Z",
"published": "2022-05-24T19:15:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22535"
},
{
"type": "WEB",
"url": "https://support.microfocus.com/kb/doc.php?id=7025273"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-C4X3-H9WG-9X78
Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-11 00:00Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent denial of service.
{
"affected": [],
"aliases": [
"CVE-2022-36848"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-09T15:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Authorization vulnerability in setDualDARPolicyCmd prior to SMR Sep-2022 Release 1 allows local attackers to cause local permanent denial of service.",
"id": "GHSA-c4x3-h9wg-9x78",
"modified": "2022-09-11T00:00:29Z",
"published": "2022-09-10T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36848"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=09"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C553-7Q8C-VQG8
Vulnerability from github – Published: 2022-12-21 15:30 – Updated: 2022-12-21 15:30In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel
{
"affected": [],
"aliases": [
"CVE-2022-20572"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T16:15:00Z",
"severity": "MODERATE"
},
"details": "In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel",
"id": "GHSA-c553-7q8c-vqg8",
"modified": "2022-12-21T15:30:16Z",
"published": "2022-12-21T15:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20572"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-C558-XW64-QX7V
Vulnerability from github – Published: 2026-01-09 09:31 – Updated: 2026-04-08 18:34The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new wptb-table posts.
{
"affected": [],
"aliases": [
"CVE-2025-13753"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-09T08:15:56Z",
"severity": "MODERATE"
},
"details": "The WP Table Builder \u2013 Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table() function in all versions up to, and including, 2.0.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new wptb-table posts.",
"id": "GHSA-c558-xw64-qx7v",
"modified": "2026-04-08T18:34:02Z",
"published": "2026-01-09T09:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13753"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3432381/wp-table-builder"
},
{
"type": "WEB",
"url": "https://research.cleantalk.org/cve-2025-13753"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/95f49080-2263-4f6d-9372-30137efd8e10?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-C569-4CQ6-RVG9
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-10-22 12:00A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.
{
"affected": [],
"aliases": [
"CVE-2021-1577"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-25T20:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in an API endpoint of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Application Policy Infrastructure Controller (Cloud APIC) could allow an unauthenticated, remote attacker to read or write arbitrary files on an affected system. This vulnerability is due to improper access control. An attacker could exploit this vulnerability by using a specific API endpoint to upload a file to an affected device. A successful exploit could allow the attacker to read or write arbitrary files on an affected device.",
"id": "GHSA-c569-4cq6-rvg9",
"modified": "2022-10-22T12:00:30Z",
"published": "2022-05-24T19:12:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1577"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-capic-frw-Nt3RYxR2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.