CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
5947 vulnerabilities reference this CWE, most recent first.
GHSA-9G9G-C4V9-F632
Vulnerability from github – Published: 2025-08-13 18:31 – Updated: 2025-08-14 03:31In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
{
"affected": [],
"aliases": [
"CVE-2025-51451"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-13T17:15:27Z",
"severity": "CRITICAL"
},
"details": "In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.",
"id": "GHSA-9g9g-c4v9-f632",
"modified": "2025-08-14T03:31:16Z",
"published": "2025-08-13T18:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51451"
},
{
"type": "WEB",
"url": "https://gist.github.com/lin-3-start/e42344d5caea881e5429fdd40fad1fd8"
},
{
"type": "WEB",
"url": "https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/204/ids/36.html"
},
{
"type": "WEB",
"url": "http://n200re.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GCV-6RM7-VW3W
Vulnerability from github – Published: 2022-03-26 00:00 – Updated: 2025-10-22 00:32An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.
{
"affected": [],
"aliases": [
"CVE-2022-1040"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-25T12:15:00Z",
"severity": "CRITICAL"
},
"details": "An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.",
"id": "GHSA-9gcv-6rm7-vw3w",
"modified": "2025-10-22T00:32:30Z",
"published": "2022-03-26T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1040"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-1040"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51006"
},
{
"type": "WEB",
"url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/168046/Sophos-XG115w-Firewall-17.0.10-MR-10-Authentication-Bypass.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GCX-3VM9-MG9Q
Vulnerability from github – Published: 2022-05-17 00:41 – Updated: 2022-05-17 00:41SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1.
{
"affected": [],
"aliases": [
"CVE-2008-6009"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-01-30T18:30:00Z",
"severity": "HIGH"
},
"details": "SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1.",
"id": "GHSA-9gcx-3vm9-mg9q",
"modified": "2022-05-17T00:41:40Z",
"published": "2022-05-17T00:41:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6009"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45577"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/6635"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31500"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9GCX-XJJ8-2XXM
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.
{
"affected": [],
"aliases": [
"CVE-2021-37545"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T14:15:00Z",
"severity": "HIGH"
},
"details": "In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.",
"id": "GHSA-9gcx-xjj8-2xxm",
"modified": "2022-05-24T19:10:18Z",
"published": "2022-05-24T19:10:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37545"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2021/08/05/jetbrains-security-bulletin-q2-2021"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9GF4-MQ65-QX36
Vulnerability from github – Published: 2024-07-02 21:32 – Updated: 2024-07-02 21:32Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.
{
"affected": [],
"aliases": [
"CVE-2024-20900"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-02T10:15:05Z",
"severity": "MODERATE"
},
"details": "Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentication.",
"id": "GHSA-9gf4-mq65-qx36",
"modified": "2024-07-02T21:32:13Z",
"published": "2024-07-02T21:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20900"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024\u0026month=07"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9GGQ-G75C-F8WX
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication via an HTTP request.
{
"affected": [],
"aliases": [
"CVE-2018-12575"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-02T16:29:00Z",
"severity": "CRITICAL"
},
"details": "On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication via an HTTP request.",
"id": "GHSA-9ggq-g75c-f8wx",
"modified": "2022-05-14T03:01:07Z",
"published": "2022-05-14T03:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12575"
},
{
"type": "WEB",
"url": "https://software-talk.org/blog/2018/06/tplink-wr841n-broken-auth-cve-2018-12575"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GHH-MMCQ-8PHC
Vulnerability from github – Published: 2024-06-17 22:30 – Updated: 2024-10-16 19:26Impact
A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user’s tokens still usable.
An AP must be enabled to be affected by this, as the built-in User Management feature is not affected by this vulnerability. This issue may lead to an adversary gaining unauthorized access, as the user’s access privileges may still be active within Rancher even though they are no longer valid on the configured AP (please consult the MITRE ATT&CK - Technique - Valid Accounts for further information about the associated technique of attack).
It’s important to note that all configurable APs are impacted, see Rancher Docs - Configuring Authentication - External vs. Local Authentication to get the full authentication providers list.
To address this issue, the fix introduces a new user retention process that can be configured to run periodically and disable and/or delete inactive users. If enabled a user becomes subject to retention if they don't login for a configurable period of time. It's possible to set overrides for users that are used mainly for programmatic access (e.g. CI, scripts etc.) so that they don't become subject to retention for a longer period of time or at all. The user retention process is disabled by default, to avoid deleting wrong accounts. It is up to each user to enable it and configure the retention period as it best suits its environment.
Be aware that once the process is enabled, it might take a few days for previous users that have been revoked or deleted from the AP to be automatically removed from Rancher. To attenuate the risk of this condition, we recommend to regularly audit the AP’s user accounts for activity and manually deactivate or remove them from Rancher, if they are no longer needed.
For further information about the user retention process configuration, please refer to the dedicated documentation Rancher Docs - Advanced User Guides - Enable User Retention.
Patches
Patched versions include releases 2.7.14 and 2.8.5.
Workarounds
Administrators that are unable to update to a patched Rancher Manager version, are advised to delete Rancher users, via kubectl or through the UI, as soon as those users are deleted from the Authentication Provider. If a user needs to be temporarily disabled on the Authentication Provider, similar intervention will need to take place to reflect that change on Rancher Manager.
Below is a procedure to list and remove a deleted/disabled user in Rancher using kubectl (with a privileged kubeconfig).
- List all users bound to a supported external auth provider, then returns
username,uid,displayNameandPrincipalIdswhich contains the relatedauthprovider_user://ID
#!/bin/bash
for authprovider in {activedirectory,azure,common,genericoidc,github googleauth, keycloakoidc,ldap,oidc,publicapi,saml}
do
kubectl get users -o json | jq --arg authprovider "$authprovider" '.items[] | select(.principalIds[] | test("^" + $authprovider + "_user://")) | {username: .metadata.name, uid: .metadata.uid, displayName: .displayName, principalIds: .principalIds}'
done
- Once the
authprovider_user://ID(and/orDisplayName) is confirmed, remove the user from the Rancher UI or usingkubectl delete users <USERNAME>.
For more information
If you have any questions or comments about this advisory:
- Reach out to the SUSE Rancher Security team for security related inquiries.
- Open an issue in the Rancher repository.
- Verify with our support matrix and product support lifecycle.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-22650"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-306",
"CWE-613"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T22:30:46Z",
"nvd_published_at": "2024-10-16T09:15:02Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider (AP). This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the user\u2019s tokens still usable.\n\nAn AP must be enabled to be affected by this, as the built-in User Management feature is not affected by this vulnerability.\nThis issue may lead to an adversary gaining unauthorized access, as the user\u2019s access privileges may still be active within Rancher even though they are no longer valid on the configured AP (please consult the [MITRE ATT\u0026CK - Technique - Valid Accounts](https://attack.mitre.org/techniques/T1078/) for further information about the associated technique of attack).\n\nIt\u2019s important to note that all configurable APs are impacted, see [Rancher Docs - Configuring Authentication - External vs. Local Authentication](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/authentication-config#external-vs-local-authentication) to get the full authentication providers list.\n\n\nTo address this issue, the fix introduces a new user retention process that can be configured to run periodically and disable and/or delete inactive users. If enabled a user becomes subject to retention if they don\u0027t login for a configurable period of time. It\u0027s possible to set overrides for users that are used mainly for programmatic access (e.g. CI, scripts etc.) so that they don\u0027t become subject to retention for a longer period of time or at all. The user retention process is disabled by default, to avoid deleting wrong accounts. It is up to each user to enable it and configure the retention period as it best suits its environment.\n\nBe aware that once the process is enabled, it might take a few days for previous users that have been revoked or deleted from the AP to be automatically removed from Rancher. To attenuate the risk of this condition, we recommend to regularly audit the AP\u2019s user accounts for activity and manually deactivate or remove them from Rancher, if they are no longer needed.\n\nFor further information about the user retention process configuration, please refer to the dedicated documentation [Rancher Docs - Advanced User Guides - Enable User Retention](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-user-retention).\n\n### Patches\n\nPatched versions include releases `2.7.14` and `2.8.5`.\n\n### Workarounds\n\nAdministrators that are unable to update to a patched Rancher Manager version, are advised to delete Rancher users, via kubectl or through the UI, as soon as those users are deleted from the Authentication Provider. If a user needs to be temporarily disabled on the Authentication Provider, similar intervention will need to take place to reflect that change on Rancher Manager.\n\n\nBelow is a procedure to list and remove a deleted/disabled user in Rancher using `kubectl` (with a privileged kubeconfig).\n\n1. List all users bound to a supported external auth provider, then returns `username`, `uid`, `displayName` and `PrincipalIds` which contains the related `authprovider_user://ID`\n\n```shell\n#!/bin/bash\n\nfor authprovider in {activedirectory,azure,common,genericoidc,github googleauth, keycloakoidc,ldap,oidc,publicapi,saml}\ndo \n\tkubectl get users -o json | jq --arg authprovider \"$authprovider\" \u0027.items[] | select(.principalIds[] | test(\"^\" + $authprovider + \"_user://\")) | {username: .metadata.name, uid: .metadata.uid, displayName: .displayName, principalIds: .principalIds}\u0027\ndone\n```\n\n2. Once the `authprovider_user://ID` (and/or `DisplayName`) is confirmed, remove the user from the Rancher UI or using `kubectl delete users \u003cUSERNAME\u003e`.\n\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n",
"id": "GHSA-9ghh-mmcq-8phc",
"modified": "2024-10-16T19:26:09Z",
"published": "2024-06-17T22:30:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-9ghh-mmcq-8phc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22650"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22650"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/rancher"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider"
}
GHSA-9GPQ-82H8-HGX9
Vulnerability from github – Published: 2021-12-15 00:01 – Updated: 2023-08-08 15:31glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.
{
"affected": [],
"aliases": [
"CVE-2021-44949"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-14T15:15:00Z",
"severity": "CRITICAL"
},
"details": "glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.",
"id": "GHSA-9gpq-82h8-hgx9",
"modified": "2023-08-08T15:31:24Z",
"published": "2021-12-15T00:01:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44949"
},
{
"type": "WEB",
"url": "https://github.com/glFusion/glfusion/issues/487"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GQH-5752-RJF6
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2023-04-26 21:30D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters
{
"affected": [],
"aliases": [
"CVE-2013-7051"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-04T14:15:00Z",
"severity": "MODERATE"
},
"details": "D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters",
"id": "GHSA-9gqh-5752-rjf6",
"modified": "2023-04-26T21:30:29Z",
"published": "2022-05-05T00:29:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7051"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90904"
},
{
"type": "WEB",
"url": "https://www.securityfocus.com/bid/65290"
},
{
"type": "WEB",
"url": "http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/31425"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9GRP-VP5P-RX5W
Vulnerability from github – Published: 2022-05-17 02:39 – Updated: 2022-05-17 02:39An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.
{
"affected": [],
"aliases": [
"CVE-2016-9362"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-13T21:59:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.",
"id": "GHSA-9grp-vp5p-rx5w",
"modified": "2022-05-17T02:39:40Z",
"published": "2022-05-17T02:39:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9362"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-357-02"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95074"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.