CWE-287
DiscouragedImproper Authentication
Abstraction: Class · Status: Draft
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
5951 vulnerabilities reference this CWE, most recent first.
GHSA-XP2R-3X9C-RVXQ
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing authentication and gaining access to device functions.
{
"affected": [],
"aliases": [
"CVE-2018-5455"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-05T17:29:00Z",
"severity": "CRITICAL"
},
"details": "A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing authentication and gaining access to device functions.",
"id": "GHSA-xp2r-3x9c-rvxq",
"modified": "2022-05-13T01:32:09Z",
"published": "2022-05-13T01:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5455"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-060-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XP8F-6F2W-PRW8
Vulnerability from github – Published: 2022-05-17 04:48 – Updated: 2022-05-17 04:48The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.
{
"affected": [],
"aliases": [
"CVE-2014-1982"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-31T14:58:00Z",
"severity": "HIGH"
},
"details": "The administrative interface in Allied Telesis AT-RG634A ADSL Broadband router 3.3+, iMG624A firmware 3.5, iMG616LH firmware 2.4, and iMG646BD firmware 3.5 allows remote attackers to gain privileges and execute arbitrary commands via a direct request to cli.html.",
"id": "GHSA-xp8f-6f2w-prw8",
"modified": "2022-05-17T04:48:20Z",
"published": "2022-05-17T04:48:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1982"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2014/Mar/340"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/32545"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XPMM-8F6X-VCW6
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2025-04-20 03:48The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.
{
"affected": [],
"aliases": [
"CVE-2017-16562"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-10T02:29:00Z",
"severity": "CRITICAL"
},
"details": "The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the \"admin\" username, allows remote attackers to bypass authentication and obtain administrative access via a \"true\" value for the up_auto_log parameter in the QUERY_STRING to the default URI.",
"id": "GHSA-xpmm-8f6x-vcw6",
"modified": "2025-04-20T03:48:14Z",
"published": "2022-05-13T01:44:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16562"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/8950"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/43117"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XPMV-Q85X-8HH8
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-05-24 19:21On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim's host, an attacker might be able to take over the administrative session without being prompted for authentication credentials. An attacker can get the victim's and router's IP addresses by simply sniffing the network traffic. Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different network that is behind the NAT/Proxy, an attacker can sniff the network traffic to know the public IP address of the victim's router and take over his session as he won't be prompted for credentials.
{
"affected": [],
"aliases": [
"CVE-2017-7405"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-07T12:29:00Z",
"severity": "CRITICAL"
},
"details": "On the D-Link DIR-615 before v20.12PTb04, once authenticated, this device identifies the user based on the IP address of his machine. By spoofing the IP address belonging to the victim\u0027s host, an attacker might be able to take over the administrative session without being prompted for authentication credentials. An attacker can get the victim\u0027s and router\u0027s IP addresses by simply sniffing the network traffic. Moreover, if the victim has web access enabled on his router and is accessing the web interface from a different network that is behind the NAT/Proxy, an attacker can sniff the network traffic to know the public IP address of the victim\u0027s router and take over his session as he won\u0027t be prompted for credentials.",
"id": "GHSA-xpmv-q85x-8hh8",
"modified": "2022-05-24T19:21:20Z",
"published": "2022-05-24T19:21:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7405"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2017/03/12/qsa-2017-03-12/qsa-2017-03-12.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQ3V-RPGQ-HXM8
Vulnerability from github – Published: 2022-05-17 02:10 – Updated: 2022-05-17 02:10The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."
{
"affected": [],
"aliases": [
"CVE-2008-6707"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-04-10T22:00:00Z",
"severity": "MODERATE"
},
"details": "The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an \"unnecessary default application,\" (4) unspecified scripts in the states folder, (5) an unspecified \"default application\" that lists server configuration, and (6) \"full system help.\"",
"id": "GHSA-xq3v-rpgq-hxm8",
"modified": "2022-05-17T02:10:28Z",
"published": "2022-05-17T02:10:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6707"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43381"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43384"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43389"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43393"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43394"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43395"
},
{
"type": "WEB",
"url": "http://osvdb.org/46598"
},
{
"type": "WEB",
"url": "http://osvdb.org/46599"
},
{
"type": "WEB",
"url": "http://osvdb.org/46600"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30751"
},
{
"type": "WEB",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29939"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=86"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=87"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=88"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=89"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=90"
},
{
"type": "WEB",
"url": "http://www.voipshield.com/research-details.php?id=91"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1943/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XQ44-W95M-VR58
Vulnerability from github – Published: 2022-05-02 03:31 – Updated: 2022-05-02 03:31Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.
{
"affected": [],
"aliases": [
"CVE-2009-2071"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-06-15T19:30:00Z",
"severity": "MODERATE"
},
"details": "Google Chrome before 1.0.154.53 displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server, which allows man-in-the-middle attackers to spoof an arbitrary https site by letting a browser obtain a valid certificate from this site during one request, and then sending the browser a crafted 502 response page upon a subsequent request.",
"id": "GHSA-xq44-w95m-vr58",
"modified": "2022-05-02T03:31:35Z",
"published": "2022-05-02T03:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2071"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=479880"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=7338"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=8473"
},
{
"type": "WEB",
"url": "http://research.microsoft.com/apps/pubs/default.aspx?id=79323"
},
{
"type": "WEB",
"url": "http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf"
},
{
"type": "WEB",
"url": "http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes/releasenotes1015453"
},
{
"type": "WEB",
"url": "http://src.chromium.org/viewvc/chrome/branches/release_154.next/src/net/http/http_transaction_winhttp.cc?r1=11621\u0026r2=11669\u0026pathrev=11669"
},
{
"type": "WEB",
"url": "http://src.chromium.org/viewvc/chrome?view=rev\u0026revision=11669"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/35411"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XQ46-C84J-2V2W
Vulnerability from github – Published: 2022-12-04 06:30 – Updated: 2022-12-06 15:30An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.
{
"affected": [],
"aliases": [
"CVE-2022-46411"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-798"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-04T05:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation and may be discovered and used to escalate privileges.",
"id": "GHSA-xq46-c84j-2v2w",
"modified": "2022-12-06T15:30:30Z",
"published": "2022-12-04T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46411"
},
{
"type": "WEB",
"url": "https://www.veritas.com/content/support/en_US/security/VTS22-019#issue3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XQ4P-GP5C-C5RW
Vulnerability from github – Published: 2022-05-17 05:48 – Updated: 2022-05-17 05:48Session fixation vulnerability in Fujitsu e-Pares V01 L01, L03, L10, L20, L30 allows remote attackers to hijack web sessions via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2010-2149"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-06-03T16:30:00Z",
"severity": "MODERATE"
},
"details": "Session fixation vulnerability in Fujitsu e-Pares V01 L01, L03, L10, L20, L30 allows remote attackers to hijack web sessions via unspecified vectors.",
"id": "GHSA-xq4p-gp5c-c5rw",
"modified": "2022-05-17T05:48:24Z",
"published": "2022-05-17T05:48:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2149"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN36925871/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000023.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40029"
},
{
"type": "WEB",
"url": "http://software.fujitsu.com/jp/security/vulnerabilities/jvn-36925871-58439007-82465391.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40513"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XQ64-R3J5-HCFG
Vulnerability from github – Published: 2023-01-18 00:30 – Updated: 2023-01-18 00:30Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
{
"affected": [],
"aliases": [
"CVE-2023-21841"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-18T00:15:00Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
"id": "GHSA-xq64-r3j5-hcfg",
"modified": "2023-01-18T00:30:17Z",
"published": "2023-01-18T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21841"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2023.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XQ66-JM6J-77VH
Vulnerability from github – Published: 2022-05-17 02:09 – Updated: 2022-05-17 02:09HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.
{
"affected": [],
"aliases": [
"CVE-2008-7008"
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-08-19T10:30:00Z",
"severity": "MODERATE"
},
"details": "HyperStop Web Host Directory 1.2 allows remote attackers to bypass authentication and download a database backup via a direct request to admin/backup/db.",
"id": "GHSA-xq66-jm6j-77vh",
"modified": "2022-05-17T02:09:56Z",
"published": "2022-05-17T02:09:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-7008"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45241"
},
{
"type": "WEB",
"url": "http://osvdb.org/48282"
},
{
"type": "WEB",
"url": "http://packetstorm.linuxsecurity.com/0809-exploits/webhost-database.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31922"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31249"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Libraries or Frameworks
Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
CAPEC-114: Authentication Abuse
An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker.
CAPEC-115: Authentication Bypass
An attacker gains access to application, service, or device with the privileges of an authorized or privileged user by evading or circumventing an authentication mechanism. The attacker is therefore able to access protected data without authentication ever having taken place.
CAPEC-151: Identity Spoofing
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials.
CAPEC-194: Fake the Source of Data
An adversary takes advantage of improper authentication to provide data or services under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or to assume the rights granted to another individual. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. The root of the attack (in this case the email system) fails to properly authenticate the source and this results in the reader incorrectly performing the instructed action. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
CAPEC-22: Exploiting Trust in Client
An attack of this type exploits vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by communicating directly with the server where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-593: Session Hijacking
This type of attack involves an adversary that exploits weaknesses in an application's use of sessions in performing authentication. The adversary is able to steal or manipulate an active session and use it to gain unathorized access to the application.
CAPEC-633: Token Impersonation
An adversary exploits a weakness in authentication to create an access token (or equivalent) that impersonates a different entity, and then associates a process/thread to that that impersonated token. This action causes a downstream user to make a decision or take action that is based on the assumed identity, and not the response that blocks the adversary.
CAPEC-650: Upload a Web Shell to a Web Server
By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.