CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
5968 vulnerabilities reference this CWE, most recent first.
GHSA-W458-886M-WPP4
Vulnerability from github – Published: 2022-05-17 00:39 – Updated: 2022-05-17 00:39Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the login cookie to 1.
{
"affected": [],
"aliases": [
"CVE-2008-6411"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-03-06T11:30:00Z",
"severity": "HIGH"
},
"details": "Explay CMS 2.1 and earlier allows remote attackers to bypass authentication and gain administrative access by setting the login cookie to 1.",
"id": "GHSA-w458-886m-wpp4",
"modified": "2022-05-17T00:39:35Z",
"published": "2022-05-17T00:39:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6411"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45300"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/6500"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31270"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W466-Q2RW-4MM2
Vulnerability from github – Published: 2022-05-17 05:22 – Updated: 2022-05-17 05:22approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.
{
"affected": [],
"aliases": [
"CVE-2012-4926"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-09-15T17:55:00Z",
"severity": "MODERATE"
},
"details": "approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.",
"id": "GHSA-w466-q2rw-4mm2",
"modified": "2022-05-17T05:22:06Z",
"published": "2022-05-17T05:22:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4926"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0180.html"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/18544"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W4H5-9MG2-VV6R
Vulnerability from github – Published: 2024-08-13 18:31 – Updated: 2024-08-22 15:31Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by the authentication mechanism. These transactions could have an impact on any sensitive aspect of the platform, including Confidentiality, Integrity and Availability.
{
"affected": [],
"aliases": [
"CVE-2024-7746"
],
"database_specific": {
"cwe_ids": [
"CWE-1392",
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T16:15:09Z",
"severity": "CRITICAL"
},
"details": "Use of Default Credentials vulnerability in Tananaev Solutions Traccar Server on Administrator Panel modules allows Authentication Abuse.This issue affects the privileged transactions implemented by the Traccar solution that should otherwise be protected by the authentication mechanism.\u00a0\nThese transactions could have an impact on any sensitive aspect of the platform, including Confidentiality, Integrity and Availability.",
"id": "GHSA-w4h5-9mg2-vv6r",
"modified": "2024-08-22T15:31:18Z",
"published": "2024-08-13T18:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7746"
},
{
"type": "WEB",
"url": "https://asrg.io/security-advisories/cve-2024-7746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-W4P5-JC3G-29J3
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
{
"affected": [],
"aliases": [
"CVE-2020-29379"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-29T01:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.",
"id": "GHSA-w4p5-jc3g-29j3",
"modified": "2022-05-24T17:35:04Z",
"published": "2022-05-24T17:35:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29379"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2020/Jul/14"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-W4PR-4VJG-HFFH
Vulnerability from github – Published: 2022-09-30 22:56 – Updated: 2022-09-30 22:56When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.
This allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.
For more information
If you have any questions or comments about this advisory, e-mail us at poljar@termina.org.uk.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "matrix-nio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39254"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-322"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-30T22:56:17Z",
"nvd_published_at": "2022-09-29T15:15:00Z",
"severity": "HIGH"
},
"details": "When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn\u0027t check that the device that responded matches the device the key was requested from.\n\nThis allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.\n\n### For more information\nIf you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).",
"id": "GHSA-w4pr-4vjg-hffh",
"modified": "2022-09-30T22:56:17Z",
"published": "2022-09-30T22:56:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/poljar/matrix-nio/security/advisories/GHSA-w4pr-4vjg-hffh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39254"
},
{
"type": "WEB",
"url": "https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0"
},
{
"type": "PACKAGE",
"url": "https://github.com/poljar/matrix-nio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "When matrix-nio receives forwarded room keys, the receiver doesn\u0027t check if it requested the key from the forwarder"
}
GHSA-W4Q6-HMCG-GWMG
Vulnerability from github – Published: 2023-03-24 21:30 – Updated: 2023-03-30 15:30In serializePasspointConfiguration of PasspointXmlUtils.java, there is a possible logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-216854451
{
"affected": [],
"aliases": [
"CVE-2023-21027"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z",
"severity": "HIGH"
},
"details": "In serializePasspointConfiguration of PasspointXmlUtils.java, there is a possible logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-216854451",
"id": "GHSA-w4q6-hmcg-gwmg",
"modified": "2023-03-30T15:30:20Z",
"published": "2023-03-24T21:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21027"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-03-01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W4R4-65MG-45X2
Vulnerability from github – Published: 2018-11-09 17:41 – Updated: 2024-06-10 21:41From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future 2.4.x versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.spark:spark-core_2.11"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.spark:spark-core_2.10"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "2.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-11770"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:59:32Z",
"nvd_published_at": "2018-08-13T16:29:00Z",
"severity": "MODERATE"
},
"details": "From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future 2.4.x versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027.",
"id": "GHSA-w4r4-65mg-45x2",
"modified": "2024-06-10T21:41:52Z",
"published": "2018-11-09T17:41:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11770"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485@%3Cdev.spark.apache.org%3E"
},
{
"type": "WEB",
"url": "https://spark.apache.org/security.html#CVE-2018-11770"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227114942/http://www.securityfocus.com/bid/105097"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability"
}
GHSA-W4VP-6X5P-CM7M
Vulnerability from github – Published: 2022-04-22 00:00 – Updated: 2026-06-22 21:30An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an "Accept: application/json" header.
{
"affected": [],
"aliases": [
"CVE-2022-29534"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-20T23:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vectors involving an \"Accept: application/json\" header.",
"id": "GHSA-w4vp-6x5p-cm7m",
"modified": "2026-06-22T21:30:44Z",
"published": "2022-04-22T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29534"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/01120163a6b4d905029d416e7305575df31df8af"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/compare/v2.4.157...v2.4.158"
},
{
"type": "WEB",
"url": "https://zigrin.com/advisories/misp-password-confirmation-can-be-bypassed"
},
{
"type": "WEB",
"url": "https://zigrin.com/cakephp-application-cybersecurity-research-the-impact-of-a-php-vulnerability-exploring-the-password-confirmation-bypass-in-misp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W4WF-4WG4-M73G
Vulnerability from github – Published: 2022-05-14 01:12 – Updated: 2022-05-14 01:12Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.
{
"affected": [],
"aliases": [
"CVE-2018-12192"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-14T20:29:00Z",
"severity": "HIGH"
},
"details": "Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.",
"id": "GHSA-w4wf-4wg4-m73g",
"modified": "2022-05-14T01:12:48Z",
"published": "2022-05-14T01:12:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12192"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190318-0001"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03914en_us"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W4WV-M3JP-8PC7
Vulnerability from github – Published: 2022-05-17 05:18 – Updated: 2022-05-17 05:18freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
{
"affected": [],
"aliases": [
"CVE-2012-6067"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-12-04T23:55:00Z",
"severity": "HIGH"
},
"details": "freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.",
"id": "GHSA-w4wv-m3jp-8pc7",
"modified": "2022-05-17T05:18:15Z",
"published": "2022-05-17T05:18:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6067"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0011.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.