CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5808 vulnerabilities reference this CWE, most recent first.
GHSA-95XR-XPJ5-H4G4
Vulnerability from github – Published: 2023-09-06 18:30 – Updated: 2024-09-26 21:31A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.
{
"affected": [],
"aliases": [
"CVE-2023-38486"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-06T18:15:08Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the secure boot implementation on affected\u00a0Aruba 9200 and 9000 Series Controllers and Gateways allows\u00a0an attacker to bypass security controls which would normally\u00a0prohibit unsigned kernel images from executing. An attacker\u00a0can use this vulnerability to execute arbitrary runtime\u00a0operating systems, including unverified and unsigned OS\u00a0images.",
"id": "GHSA-95xr-xpj5-h4g4",
"modified": "2024-09-26T21:31:10Z",
"published": "2023-09-06T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38486"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-014.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9642-Q8FH-RW5M
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.
{
"affected": [],
"aliases": [
"CVE-2022-27575"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-668",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "MODERATE"
},
"details": "Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.",
"id": "GHSA-9642-q8fh-rw5m",
"modified": "2022-04-19T00:01:14Z",
"published": "2022-04-12T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27575"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-964W-F6GJ-5236
Vulnerability from github – Published: 2026-07-28 22:26 – Updated: 2026-07-28 22:26Summary
sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.
Finding (Medium): trailing-slash ACL and hidden-file bypass
httpserver/handler.go, sendFile (lines 789-801) takes the filename from the RAW req.URL.Path while the file itself is opened from the filepath.Clean-ed path. The two disagree, and a trailing slash makes the derived name the empty string. Both protections key on that derived name, so both are defeated: the rule that never serves the .goshs ACL file, and the acl.Block list.
Measured, with negative controls:
GET /blocked/secret.txt -> 404 (control, correctly blocked)
GET /blocked/secret.txt/ -> 200 + contents
GET /blocked/.goshs/ -> 200, returns the ACL file itself,
including the admin:$2a$... bcrypt hash
Unauthenticated when the ACL is configured block-only (common usage). Stated precisely: AUTHENTICATION IS NOT BYPASSED. An unauthenticated request against a directory protected by authentication still returns 401 under the same trick; I tested that. The claim is specifically that the block list and the ACL-file protection are bypassed. In-tree evidence that sendFile is the defect: the sibling handlers doDir and bulkDownload both derive the name correctly; sendFile is the lone outlier.
Suggested fixes
- Derive the served filename from the same cleaned path used to open the file, so the authorization decision and the file access cannot disagree.
Tooling
AI assistance was used while investigating. The finding was reproduced against a running server on loopback with negative controls, including the 404-versus-200 pair and the authenticated-directory control that shows authentication is not affected.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.4"
},
"package": {
"ecosystem": "Go",
"name": "github.com/patrickhener/goshs/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.5-0.20260727065949-f3ef599e4091"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.4"
},
"package": {
"ecosystem": "Go",
"name": "goshs.de/goshs/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.5-0.20260727065949-f3ef599e4091"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/patrickhener/goshs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "goshs.de/goshs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-66064"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-41",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-28T22:26:28Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\n`sendFile` derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list. \n\n## Finding (Medium): trailing-slash ACL and hidden-file bypass\n\nhttpserver/handler.go, sendFile (lines 789-801) takes the filename from the RAW req.URL.Path while the file itself is opened from the filepath.Clean-ed path. The two disagree, and a trailing slash makes the derived name the empty string. Both protections key on that derived name, so both are defeated: the rule that never serves the .goshs ACL file, and the acl.Block list.\n\nMeasured, with negative controls:\n\n```\nGET /blocked/secret.txt -\u003e 404 (control, correctly blocked)\nGET /blocked/secret.txt/ -\u003e 200 + contents\nGET /blocked/.goshs/ -\u003e 200, returns the ACL file itself,\n including the admin:$2a$... bcrypt hash\n```\n\nUnauthenticated when the ACL is configured block-only (common usage). Stated precisely: AUTHENTICATION IS NOT BYPASSED. An unauthenticated request against a directory protected by authentication still returns 401 under the same trick; I tested that. The claim is specifically that the block list and the ACL-file protection are bypassed. In-tree evidence that sendFile is the defect: the sibling handlers doDir and bulkDownload both derive the name correctly; sendFile is the lone outlier.\n\n## Suggested fixes\n\n1. Derive the served filename from the same cleaned path used to open the file, so the authorization decision and the file access cannot disagree.\n\n## Tooling\n\nAI assistance was used while investigating. The finding was reproduced against a running server on loopback with negative controls, including the 404-versus-200 pair and the authenticated-directory control that shows authentication is not affected.",
"id": "GHSA-964w-f6gj-5236",
"modified": "2026-07-28T22:26:28Z",
"published": "2026-07-28T22:26:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-964w-f6gj-5236"
},
{
"type": "WEB",
"url": "https://github.com/goshs-labs/goshs/pull/222"
},
{
"type": "WEB",
"url": "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/goshs-labs/goshs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "goshs has ACL Bypass \u0026 Path Traversal"
}
GHSA-965R-9CG9-G42P
Vulnerability from github – Published: 2025-05-28 14:38 – Updated: 2025-06-04 20:48Impact
All objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.
If object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.
Attack requirements
The following conditions have to be met in order to perform this attack:
- A user must be logged in
- No relevant application roles are required
- At least one object-type must be configured via object-management
- The scope of the attack is limited to objects that are configured via object-management.
- The value of showInDataMenu is irrelevant for this attack
Patches
This issue was patched in version 12.13.0.RELEASE.
Workarounds
It is possible to override the endpoint security as defined in ObjectenApiHttpSecurityConfigurer and ObjectManagementHttpSecurityConfigurer. Depending on the implementation, this could result in loss of functionality.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:objecten-api"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0.RELEASE"
},
{
"last_affected": "11.3.3.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:object-management"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0.RELEASE"
},
{
"last_affected": "11.3.3.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:object-management"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0.RELEASE"
},
{
"fixed": "12.13.0.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:objecten-api"
},
"ranges": [
{
"events": [
{
"introduced": "12.0.0.RELEASE"
},
{
"fixed": "12.13.0.RELEASE"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48881"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-28T14:38:54Z",
"nvd_published_at": "2025-05-30T06:15:28Z",
"severity": "HIGH"
},
"details": "### Impact\nAll objects for which an object-management configuration exists can be listed, viewed, edited, created or deleted by unauthorised users.\n\nIf object-urls are exposed via other channels, the contents of these objects can be viewed independent of object-management configurations.\n\n### Attack requirements\nThe following conditions have to be met in order to perform this attack:\n- A user must be logged in\n - No relevant application roles are required\n- At least one object-type must be configured via object-management\n - The scope of the attack is limited to objects that are configured via object-management.\n - The value of `showInDataMenu` is irrelevant for this attack\n\n### Patches\nThis issue was patched in version 12.13.0.RELEASE.\n\n### Workarounds\nIt is possible to override the endpoint security as defined in `ObjectenApiHttpSecurityConfigurer` and `ObjectManagementHttpSecurityConfigurer`. Depending on the implementation, this could result in loss of functionality.",
"id": "GHSA-965r-9cg9-g42p",
"modified": "2025-06-04T20:48:00Z",
"published": "2025-05-28T14:38:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries/security/advisories/GHSA-965r-9cg9-g42p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48881"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries/commit/6ab04b30d3dab816bfea32d40ba50e5dd4517272"
},
{
"type": "PACKAGE",
"url": "https://github.com/valtimo-platform/valtimo-backend-libraries"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Valtimo backend libraries allows objects in the object-api to be accessed and modified by unauthorized users"
}
GHSA-9662-JC44-MGQR
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-06-29 00:00An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11and below, 5.6.11and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.
{
"affected": [],
"aliases": [
"CVE-2021-32587"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T11:15:00Z",
"severity": "MODERATE"
},
"details": "An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11and below, 5.6.11and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration.",
"id": "GHSA-9662-jc44-mgqr",
"modified": "2022-06-29T00:00:52Z",
"published": "2022-05-24T19:10:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32587"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-059"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9672-4FH3-MCFG
Vulnerability from github – Published: 2022-11-10 12:01 – Updated: 2022-11-11 12:00Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project's Audit Events and Developers or Maintainers to view the group's Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.
{
"affected": [],
"aliases": [
"CVE-2022-3413"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-10T00:15:00Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization during display of Audit Events in GitLab EE affecting all versions from 14.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allowed Developers to view the project\u0027s Audit Events and Developers or Maintainers to view the group\u0027s Audit Events. These should have been restricted to Project Maintainers, Group Owners, and above.",
"id": "GHSA-9672-4fh3-mcfg",
"modified": "2022-11-11T12:00:29Z",
"published": "2022-11-10T12:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3413"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3413.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/374926"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-967V-9XQG-GJXG
Vulnerability from github – Published: 2025-10-02 15:31 – Updated: 2025-10-08 18:30Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user's team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).
{
"affected": [],
"aliases": [
"CVE-2025-11239"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-02T13:15:31Z",
"severity": "LOW"
},
"details": "Potentially sensitive information in jobs on KNIME Business Hub prior to 1.16.0 were visible to all members of the user\u0027s team. Starting with KNIME Business Hub 1.16.0 only metadata of jobs is shown to team members. Only the creator of a job can see all information including in- and output data (if present).",
"id": "GHSA-967v-9xqg-gjxg",
"modified": "2025-10-08T18:30:15Z",
"published": "2025-10-02T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11239"
},
{
"type": "WEB",
"url": "https://www.knime.com/security/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-969G-RQ57-C79H
Vulnerability from github – Published: 2025-01-22 18:31 – Updated: 2025-01-22 19:30Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they're no longer entitled to.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:folder-auth"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "217.vd5b"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-24401"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-22T19:30:30Z",
"nvd_published_at": "2025-01-22T17:15:14Z",
"severity": "MODERATE"
},
"details": "Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users formerly granted (typically optional permissions, like Overall/Manage) to access functionality they\u0027re no longer entitled to.",
"id": "GHSA-969g-rq57-c79h",
"modified": "2025-01-22T19:30:30Z",
"published": "2025-01-22T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24401"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/folder-auth-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-01-22/#SECURITY-3062"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Disabled permissions can be granted by Folder-based in Jenkins Authorization Strategy Plugin"
}
GHSA-969P-8QF6-MRVC
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2023-06-23 21:30Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity.
{
"affected": [],
"aliases": [
"CVE-2022-24002"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity.",
"id": "GHSA-969p-8qf6-mrvc",
"modified": "2023-06-23T21:30:26Z",
"published": "2022-02-12T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24002"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-969X-WV76-2JW5
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.
{
"affected": [],
"aliases": [
"CVE-2018-17857"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-09T21:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access level violation.",
"id": "GHSA-969x-wv76-2jw5",
"modified": "2022-05-13T01:50:35Z",
"published": "2022-05-13T01:50:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17857"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/753-20181003-core-access-level-violation-in-com-tags"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105559"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041914"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.