Common Weakness Enumeration

CWE-287

Discouraged

Improper Authentication

Abstraction: Class · Status: Draft

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

5961 vulnerabilities reference this CWE, most recent first.

GHSA-597F-5VMR-5J7P

Vulnerability from github – Published: 2022-05-13 01:45 – Updated: 2022-05-13 01:45

Details

A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to bypass the access control list (ACL) for specific TCP and UDP traffic. More Information: CSCvc68229. Known Affected Releases: 9.6(2). Known Fixed Releases: 99.1(20.1) 99.1(10.2) 98.1(12.7) 98.1(1.49) 97.1(6.58) 97.1(0.134) 96.2(0.109) 9.7(1.1) 9.6(2.99) 9.6(2.8).

Severity

5.3 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-3867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-03-17T22:59:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the Border Gateway Protocol (BGP) Bidirectional Forwarding Detection (BFD) implementation of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to bypass the access control list (ACL) for specific TCP and UDP traffic. More Information: CSCvc68229. Known Affected Releases: 9.6(2). Known Fixed Releases: 99.1(20.1) 99.1(10.2) 98.1(12.7) 98.1(1.49) 97.1(6.58) 97.1(0.134) 96.2(0.109) 9.7(1.1) 9.6(2.99) 9.6(2.8).",
  "id": "GHSA-597f-5vmr-5j7p",
  "modified": "2022-05-13T01:45:56Z",
  "published": "2022-05-13T01:45:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3867"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asa"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/96926"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1038051"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5985-4QRP-5J97

Vulnerability from github – Published: 2022-05-17 03:47 – Updated: 2022-05-17 03:47

Details

The Adaptive Security Device Management (ASDM) remote-management feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.6) does not properly implement the authentication-certificate option, which allows remote attackers to bypass authentication via a TCP session to an ASDM interface, aka Bug ID CSCuh44815.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-5511"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-10-13T10:20:00Z",
    "severity": "HIGH"
  },
  "details": "The Adaptive Security Device Management (ASDM) remote-management feature in Cisco Adaptive Security Appliance (ASA) Software 8.2.x before 8.2(5.46), 8.3.x before 8.3(2.39), 8.4.x before 8.4(6), 8.5.x before 8.5(1.18), 8.6.x before 8.6(1.12), 8.7.x before 8.7(1.7), 9.0.x before 9.0(3.1), and 9.1.x before 9.1(2.6) does not properly implement the authentication-certificate option, which allows remote attackers to bypass authentication via a TCP session to an ASDM interface, aka Bug ID CSCuh44815.",
  "id": "GHSA-5985-4qrp-5j97",
  "modified": "2022-05-17T03:47:50Z",
  "published": "2022-05-17T03:47:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5511"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5511"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-599H-8WPJ-75XJ

Vulnerability from github – Published: 2021-06-23 17:23 – Updated: 2021-05-20 21:24

Summary

Authentication Bypass in tyk-identity-broker

Details

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/tyktechnologies/tyk-identity-broker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23365"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-20T21:24:49Z",
    "nvd_published_at": "2021-04-26T10:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn\u2019t guarantee integrity in the XML round-trip (encoding/decoding XML data).",
  "id": "GHSA-599h-8wpj-75xj",
  "modified": "2021-05-20T21:24:49Z",
  "published": "2021-06-23T17:23:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23365"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TykTechnologies/tyk-identity-broker/pull/147"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TykTechnologies/tyk-identity-broker/commit/243092965b0f93a95a14cb882b5b9a3df61dd5c0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TykTechnologies/tyk-identity-broker/commit/46f70420e0911e4e8b638575e29d394c227c75d0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TykTechnologies/tyk-identity-broker/releases/tag/v1.1.1"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTYKTECHNOLOGIESTYKIDENTITYBROKER-1089720"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authentication Bypass in tyk-identity-broker"
}

GHSA-59G7-Q3PQ-JV2X

Vulnerability from github – Published: 2023-09-13 21:30 – Updated: 2024-04-04 07:39

Details

PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-4568"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-13T21:15:07Z",
    "severity": "MODERATE"
  },
  "details": "PaperCut NG allows for unauthenticated XMLRPC commands to be run by default. Versions 22.0.12 and below are confirmed to be affected, but later versions may also be affected due to lack of a vendor supplied patch.",
  "id": "GHSA-59g7-q3pq-jv2x",
  "modified": "2024-04-04T07:39:37Z",
  "published": "2023-09-13T21:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4568"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2023-31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59GG-H898-V8M7

Vulnerability from github – Published: 2024-03-25 09:32 – Updated: 2025-04-01 18:30

Details

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-2862"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-640"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-25T07:15:50Z",
    "severity": "CRITICAL"
  },
  "details": "This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.",
  "id": "GHSA-59gg-h898-v8m7",
  "modified": "2025-04-01T18:30:38Z",
  "published": "2024-03-25T09:32:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2862"
    },
    {
      "type": "WEB",
      "url": "https://lgsecurity.lge.com/bulletins/idproducts#updateDetails"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59M6-82QM-VQGJ

Vulnerability from github – Published: 2023-07-21 20:17 – Updated: 2023-07-21 20:17

Summary

Dapr API token authentication bypass in HTTP endpoints

Details

Summary

A vulnerability has been found in Dapr that allows bypassing API token authentication, which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request.

Users who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 and 1.11.2.

Impact

This vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the dapr-api-token in the request is invalid or missing.

Patches

The issue has been fixed in Dapr 1.10.9 and 1.11.2.

Details

When API token authentication is enabled, Dapr requires all calls from applications to include the dapr-api-token header, with a value matching what's included in the Dapr's configuration. In order to allow for healthchecks to work, the /v1.0/healthz and /v1.0/healthz/outbound HTTP APIs are excluded from the API token authentication check, and are always allowed.

Dapr <= 1.10.8 and <= 1.11.1 implemented the allowlisting of the healthcheck endpoints by permitting all requests whose URL contains /healthz to bypass the API token authentication check. The match applied anywhere in the URL, including the querystring.

As a consequence, attackers were able to bypass API token authentication by including /healthz anywhere in the URL, including as a querystring parameter. This allowed attackers to invoke any Dapr API using HTTP, including perform service invocation.

Proof of Concept

``` $ curl -v http://localhost:3500/v1.0/metadata * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: /

Mark bundle as not supporting multiuse < HTTP/1.1 401 Unauthorized < Date: Mon, 17 Jul 2023 18:13:13 GMT < Content-Type: text/plain; charset=utf-8 < Content-Length: 17 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <

Connection #0 to host localhost left intact invalid api token

$ curl -v http://localhost:3500/v1.0/metadata -H "dapr-api-token: mytoken" * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: / dapr-api-token: mytoken

Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Date: Mon, 17 Jul 2023 18:13:26 GMT < Content-Type: application/json < Content-Length: 119 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <

Connection #0 to host localhost left intact {"id":"foo","actors":[],"extended":{"daprRuntimeVersion":"v1.11.1"},"components":[],"httpEndpoints":[],"subscriptions":[]}

$ curl -v http://localhost:3500/v1.0/metadata?foo=/healthz * Trying ::1:3500... * Connected to localhost (::1) port 3500 (#0)

GET /v1.0/metadata?foo=/healthz HTTP/1.1 Host: localhost:3500 User-Agent: curl/7.74.0 Accept: /

Mark bundle as not supporting multiuse < HTTP/1.1 200 OK < Date: Mon, 17 Jul 2023 18:13:44 GMT < Content-Type: application/json < Content-Length: 119 < Traceparent: 00-00000000000000000000000000000000-0000000000000000-00 <

Connection #0 to host localhost left intact {"id":"foo","actors":[],"extended":{"daprRuntimeVersion":"v1.11.1"},"components":[],"httpEndpoints":[],"subscriptions":[]}

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dapr/dapr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.11.0"
            },
            {
              "fixed": "1.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/dapr/dapr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-37918"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-305"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-21T20:17:36Z",
    "nvd_published_at": "2023-07-21T21:15:11Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n\nA vulnerability has been found in Dapr that allows bypassing [API token authentication](https://docs.dapr.io/operations/security/api-token/), which is used by the Dapr sidecar to authenticate calls coming from the application, with a well-crafted HTTP request.\n\n\nUsers who leverage API token authentication are encouraged to upgrade Dapr to 1.10.9 and 1.11.2.\n\n\n### Impact\n\n\nThis vulnerability impacts Dapr users who have configured API token authentication. An attacker could craft a request that is always allowed by the Dapr sidecar over HTTP, even if the `dapr-api-token` in the request is invalid or missing.\n\n\n### Patches\n\n\nThe issue has been fixed in Dapr 1.10.9 and 1.11.2.\n\n\n### Details\n\n\nWhen API token authentication is enabled, Dapr requires all calls from applications to include the `dapr-api-token` header, with a value matching what\u0027s included in the Dapr\u0027s configuration. In order to allow for healthchecks to work, the `/v1.0/healthz` and `/v1.0/healthz/outbound` HTTP APIs are excluded from the API token authentication check, and are always allowed.\n\n\nDapr \u003c= 1.10.8 and \u003c= 1.11.1 implemented the allowlisting of the healthcheck endpoints by permitting all requests whose URL contains `/healthz` to bypass the API token authentication check. The match applied anywhere in the URL, including the querystring.\n\n\nAs a consequence, attackers were able to bypass API token authentication by including `/healthz` anywhere in the URL, including as a querystring parameter. This allowed attackers to invoke any Dapr API using HTTP, including perform service invocation.\n\n\n### Proof of Concept\n\n\n```\n$ curl -v http://localhost:3500/v1.0/metadata\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 401 Unauthorized\n\u003c Date: Mon, 17 Jul 2023 18:13:13 GMT\n\u003c Content-Type: text/plain; charset=utf-8\n\u003c Content-Length: 17\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\ninvalid api token\n\n\n$ curl -v http://localhost:3500/v1.0/metadata -H \"dapr-api-token: mytoken\"\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e dapr-api-token: mytoken\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 200 OK\n\u003c Date: Mon, 17 Jul 2023 18:13:26 GMT\n\u003c Content-Type: application/json\n\u003c Content-Length: 119\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\n{\"id\":\"foo\",\"actors\":[],\"extended\":{\"daprRuntimeVersion\":\"v1.11.1\"},\"components\":[],\"httpEndpoints\":[],\"subscriptions\":[]}\n\n\n$ curl -v http://localhost:3500/v1.0/metadata?foo=/healthz\n* Trying ::1:3500...\n* Connected to localhost (::1) port 3500 (#0)\n\u003e GET /v1.0/metadata?foo=/healthz HTTP/1.1\n\u003e Host: localhost:3500\n\u003e User-Agent: curl/7.74.0\n\u003e Accept: */*\n\u003e\n* Mark bundle as not supporting multiuse\n\u003c HTTP/1.1 200 OK\n\u003c Date: Mon, 17 Jul 2023 18:13:44 GMT\n\u003c Content-Type: application/json\n\u003c Content-Length: 119\n\u003c Traceparent: 00-00000000000000000000000000000000-0000000000000000-00\n\u003c\n* Connection #0 to host localhost left intact\n{\"id\":\"foo\",\"actors\":[],\"extended\":{\"daprRuntimeVersion\":\"v1.11.1\"},\"components\":[],\"httpEndpoints\":[],\"subscriptions\":[]}\n",
  "id": "GHSA-59m6-82qm-vqgj",
  "modified": "2023-07-21T20:17:36Z",
  "published": "2023-07-21T20:17:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/security/advisories/GHSA-59m6-82qm-vqgj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37918"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/commit/83ca1abb11ffe34211db55dcd36d96b94252827a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dapr/dapr/commit/99d6799c97b79397443c8c96737c9b893126a1ae"
    },
    {
      "type": "WEB",
      "url": "https://docs.dapr.io/operations/security/api-token"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dapr/dapr"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dapr API token authentication bypass in HTTP endpoints"
}

GHSA-59PM-5FMX-C85C

Vulnerability from github – Published: 2022-04-02 00:00 – Updated: 2022-04-09 00:00

Details

Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server.

Severity

6.7 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-23156"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-01T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by providing invalid input in order to obtain a connection to WMS server.",
  "id": "GHSA-59pm-5fmx-c85c",
  "modified": "2022-04-09T00:00:43Z",
  "published": "2022-04-02T00:00:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23156"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/000196005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59R2-W2XQ-GP88

Vulnerability from github – Published: 2023-07-26 15:30 – Updated: 2023-12-28 18:30

Details

Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource

Severity

4.6 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-3622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-26T15:15:10Z",
    "severity": "MODERATE"
  },
  "details": "\n Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource ",
  "id": "GHSA-59r2-w2xq-gp88",
  "modified": "2023-12-28T18:30:32Z",
  "published": "2023-07-26T15:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3622"
    },
    {
      "type": "WEB",
      "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2023-3_release_notes.htm"
    },
    {
      "type": "WEB",
      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-3622"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59R9-3G5V-J3XJ

Vulnerability from github – Published: 2022-05-17 01:23 – Updated: 2022-05-17 01:23

Details

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-4831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-11-28T02:59:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.",
  "id": "GHSA-59r9-3g5v-j3xj",
  "modified": "2022-05-17T01:23:02Z",
  "published": "2022-05-17T01:23:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4831"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95581"
    },
    {
      "type": "WEB",
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21691211"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-59RR-QHH3-G554

Vulnerability from github – Published: 2022-07-21 00:00 – Updated: 2022-07-28 00:00

Details

SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-2141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-20T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication.",
  "id": "GHSA-59rr-qhh3-g554",
  "modified": "2022-07-28T00:00:40Z",
  "published": "2022-07-21T00:00:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2141"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Architecture and Design

Strategy: Libraries or Frameworks

Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

CAPEC-114: Authentication Abuse

An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.

CAPEC-115: Authentication Bypass

An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.

CAPEC-151: Identity Spoofing

Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.

CAPEC-194: Fake the Source of Data

An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

CAPEC-22: Exploiting Trust in Client

An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.

CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data

This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.

CAPEC-593: Session Hijacking

This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.

CAPEC-633: Token Impersonation

An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.

CAPEC-650: Upload a Web Shell to a Web Server

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

CAPEC-94: Adversary in the Middle (AiTM)

An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.

← Back to the CWE list