Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

5658 vulnerabilities reference this CWE, most recent first.

GHSA-2268-HC24-W7PM

Vulnerability from github – Published: 2022-12-13 21:30 – Updated: 2022-12-13 21:30
VLAI
Details

Azure Network Watcher Agent Security Feature Bypass Vulnerability.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-44699"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-13T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Azure Network Watcher Agent Security Feature Bypass Vulnerability.",
  "id": "GHSA-2268-hc24-w7pm",
  "modified": "2022-12-13T21:30:27Z",
  "published": "2022-12-13T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44699"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44699"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44699"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-226G-QX73-56W6

Vulnerability from github – Published: 2026-03-06 00:31 – Updated: 2026-03-06 00:31
VLAI
Details

Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.

Severity
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-28709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-06T00:16:11Z",
    "severity": "MODERATE"
  },
  "details": "Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.",
  "id": "GHSA-226g-qx73-56w6",
  "modified": "2026-03-06T00:31:35Z",
  "published": "2026-03-06T00:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28709"
    },
    {
      "type": "WEB",
      "url": "https://security-advisory.acronis.com/advisories/SEC-5889"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-228V-WC5R-J8M7

Vulnerability from github – Published: 2026-03-12 14:20 – Updated: 2026-03-12 14:21
VLAI
Summary
OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream
Details

Summary

OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.

Details

The issue is in the live event streaming path.

EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:

  • service/internal/api/api.go:776

After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:

  • service/internal/api/api.go:846 OnExecutionStarted
  • service/internal/api/api.go:869 OnExecutionFinished
  • service/internal/api/api.go:1047 OnOutputChunk

The event payload includes action output through:

  • service/internal/api/api.go:295 internalLogEntryToPb
  • service/internal/api/api.go:302 Output

By contrast, the normal log APIs do apply per-action authorization checks:

  • service/internal/api/api.go:518 GetLogs
  • service/internal/api/api.go:585 GetActionLogs
  • service/internal/api/api.go:544 isLogEntryAllowed

Root cause:

  • the subscription path enforces only coarse dashboard access
  • execution callbacks broadcast to every connected client
  • no per-recipient ACL check is applied before sending action metadata or output

I validated the issue using:

  • an admin user with full ACLs
  • an alice user with no ACLs
  • a protected action that outputs TOPSECRET=alpha-bravo-charlie

Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.

PoC

Tested version:

  - 3000.10.2
  1. Fetch and check out 3000.10.2 in a clean worktree:
  git -C OliveTin fetch origin tag 3000.10.2
  git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2
  1. Copy the PoC test into the clean tree:
  cp OliveTin/service/internal/api/event_stream_leak_test.go \
    OliveTin-3000.10.2/service/internal/api/
  1. Run the targeted PoC test:
  cd OliveTin-3000.10.2/service
  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v
  1. Optional: save validation output:
  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \
    2>&1 | tee /tmp/olivetin_eventstream_3000.10.2.log

Observed validation output:

  === RUN   TestEventStreamLeaksUnauthorizedExecutionOutput
  time="2026-03-01T04:44:59-05:00" level=info msg="Action requested" actionTitle=secret-action tags="[]"
  time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - Before" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
  time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - After" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
  time="2026-03-01T04:44:59-05:00" level=info msg="Action started" actionTitle=secret-action timeout=1
  time="2026-03-01T04:44:59-05:00" level=info msg="Action finished" actionTitle=secret-action exit=0 outputLength=30 timedOut=false
  --- PASS: TestEventStreamLeaksUnauthorizedExecutionOutput (0.00s)
  PASS
  ok      github.com/OliveTin/OliveTin/internal/api       0.025s

What this proves:

  • admin can execute the protected action
  • alice has no ACLs
  • alice still receives the streamed completion event for the protected action
  • protected action output is exposed through the event stream

Impact

This is an authenticated broken access control / information disclosure vulnerability.

A low-privileged authenticated user can subscribe to EventStream and receive:

  • action execution metadata
  • execution tracking IDs
  • initiating username
  • live output chunks
  • final command output

Who is impacted:

  • multi-user OliveTin deployments
  • environments where privileged actions produce secrets, tokens, internal system details, or other sensitive operational output
  • deployments where lower-privileged authenticated users can access the dashboard and subscribe to live events

This bypasses intended per-action log/view restrictions for protected actions.

Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3000.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32102"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T14:20:16Z",
    "nvd_published_at": "2026-03-11T21:16:16Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n  OliveTin\u2019s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are\n  not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.\n\n\n\n\n### Details\nThe issue is in the live event streaming path.\n\n  EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:\n\n  - service/internal/api/api.go:776\n\n  After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:\n\n  - service/internal/api/api.go:846 OnExecutionStarted\n  - service/internal/api/api.go:869 OnExecutionFinished\n  - service/internal/api/api.go:1047 OnOutputChunk\n\n  The event payload includes action output through:\n\n  - service/internal/api/api.go:295 internalLogEntryToPb\n  - service/internal/api/api.go:302 Output\n\n  By contrast, the normal log APIs do apply per-action authorization checks:\n\n  - service/internal/api/api.go:518 GetLogs\n  - service/internal/api/api.go:585 GetActionLogs\n  - service/internal/api/api.go:544 isLogEntryAllowed\n\n  Root cause:\n\n  - the subscription path enforces only coarse dashboard access\n  - execution callbacks broadcast to every connected client\n  - no per-recipient ACL check is applied before sending action metadata or output\n\n  I validated the issue using:\n\n  - an admin user with full ACLs\n  - an alice user with no ACLs\n  - a protected action that outputs TOPSECRET=alpha-bravo-charlie\n\n  Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.\n\n\n\n### PoC\nTested version:\n```\n  - 3000.10.2\n```\n  1. Fetch and check out 3000.10.2 in a clean worktree:\n```bash\n  git -C OliveTin fetch origin tag 3000.10.2\n  git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2\n```\n  2. Copy the PoC test into the clean tree:\n```bash\n  cp OliveTin/service/internal/api/event_stream_leak_test.go \\\n    OliveTin-3000.10.2/service/internal/api/\n```\n  3. Run the targeted PoC test:\n```bash\n  cd OliveTin-3000.10.2/service\n  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v\n```\n  4. Optional: save validation output:\n```bash\n  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \\\n    2\u003e\u00261 | tee /tmp/olivetin_eventstream_3000.10.2.log\n```\n  Observed validation output:\n```bash\n  === RUN   TestEventStreamLeaksUnauthorizedExecutionOutput\n  time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action requested\" actionTitle=secret-action tags=\"[]\"\n  time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action parse args - Before\" actionTitle=secret-action cmd=\"echo \u0027TOPSECRET=alpha-bravo-charlie\u0027\"\n  time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action parse args - After\" actionTitle=secret-action cmd=\"echo \u0027TOPSECRET=alpha-bravo-charlie\u0027\"\n  time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action started\" actionTitle=secret-action timeout=1\n  time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action finished\" actionTitle=secret-action exit=0 outputLength=30 timedOut=false\n  --- PASS: TestEventStreamLeaksUnauthorizedExecutionOutput (0.00s)\n  PASS\n  ok      github.com/OliveTin/OliveTin/internal/api       0.025s\n```\n  What this proves:\n\n  - admin can execute the protected action\n  - alice has no ACLs\n  - alice still receives the streamed completion event for the protected action\n  - protected action output is exposed through the event stream\n\n\n### Impact\n  This is an authenticated broken access control / information disclosure vulnerability.\n\n  A low-privileged authenticated user can subscribe to EventStream and receive:\n\n  - action execution metadata\n  - execution tracking IDs\n  - initiating username\n  - live output chunks\n  - final command output\n\n  Who is impacted:\n\n  - multi-user OliveTin deployments\n  - environments where privileged actions produce secrets, tokens, internal system details, or other sensitive operational output\n  - deployments where lower-privileged authenticated users can access the dashboard and subscribe to live events\n\n  This bypasses intended per-action log/view restrictions for protected actions.",
  "id": "GHSA-228v-wc5r-j8m7",
  "modified": "2026-03-12T14:21:00Z",
  "published": "2026-03-12T14:20:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32102"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream"
}

GHSA-22F9-G2J6-Q686

Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-07-13 00:01
VLAI
Details

An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-31601"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-08T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. They implement a series of web services using the SOAP protocol to allow scripting interaction with the backend server. An authenticated user (regardless of privileges) can list all databases connection details and credentials.",
  "id": "GHSA-22f9-g2j6-q686",
  "modified": "2022-07-13T00:01:24Z",
  "published": "2022-05-24T19:20:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31601"
    },
    {
      "type": "WEB",
      "url": "https://www.hitachi.com/hirt/security/index.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/164779/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Insufficient-Access-Control.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-22QQ-PVP9-WMV5

Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53
VLAI
Details

Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. Due to improper permission configuration for specific operations, an attacker who obtained the Huawei ID bound to the watch can bypass permission verification to perform specific operations and modify some data on the watch.

Severity
4.6 (Medium)
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-7926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-11-13T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. Due to improper permission configuration for specific operations, an attacker who obtained the Huawei ID bound to the watch can bypass permission verification to perform specific operations and modify some data on the watch.",
  "id": "GHSA-22qq-pvp9-wmv5",
  "modified": "2022-05-13T01:53:26Z",
  "published": "2022-05-13T01:53:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7926"
    },
    {
      "type": "WEB",
      "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181031-01-watch-en"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-22VX-2X23-98W6

Vulnerability from github – Published: 2026-05-07 00:08 – Updated: 2026-05-07 00:08
VLAI
Summary
OpenSearch vulnerable to improper authorization for Rollover Requests
Details

Description

A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.

Impact

A user with indices:admin/rollover permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.

Patches

This issue is fixed in OpenSearch 2.19.4 and 3.2.0

Workarounds

Grant the indices:admin/rollover permission only to fully trusted users.

Severity
2.2 (Low)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.19.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.19.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-security"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T00:08:04Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Description\n\nA flaw was identified in the OpenSearch Security plugin\u0027s handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.\n\n### Impact\n\nA user with `indices:admin/rollover` permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.2.0\n\n### Workarounds\n\nGrant the `indices:admin/rollover` permission only to fully trusted users.",
  "id": "GHSA-22vx-2x23-98w6",
  "modified": "2026-05-07T00:08:04Z",
  "published": "2026-05-07T00:08:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/security/security/advisories/GHSA-22vx-2x23-98w6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opensearch-project/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenSearch vulnerable to improper authorization for Rollover Requests"
}

GHSA-22VX-VMHJ-V8M6

Vulnerability from github – Published: 2022-12-13 21:30 – Updated: 2025-10-22 00:32
VLAI
Details

Windows SmartScreen Security Feature Bypass Vulnerability.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-44698"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-13T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Windows SmartScreen Security Feature Bypass Vulnerability.",
  "id": "GHSA-22vx-vmhj-v8m6",
  "modified": "2025-10-22T00:32:37Z",
  "published": "2022-12-13T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44698"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44698"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44698"
    },
    {
      "type": "WEB",
      "url": "https://www.secpod.com/blog/https-www-secpod-com-blog-microsofts-november-2022-patch-tuesday-fixes-48-vulnerabilities-including-2-zero-days"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-22WF-H889-R7Q7

Vulnerability from github – Published: 2025-03-26 12:30 – Updated: 2025-10-03 09:30
VLAI
Details

Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in versions before 2.0.324.0.

Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-1542"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-425",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-26T11:15:38Z",
    "severity": "CRITICAL"
  },
  "details": "Improper permission control\u00a0vulnerability in the OXARI\u00a0ServiceDesk\u00a0application could allow an attacker\u00a0using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI\u00a0ServiceDesk in versions before 2.0.324.0.",
  "id": "GHSA-22wf-h889-r7q7",
  "modified": "2025-10-03T09:30:19Z",
  "published": "2025-03-26T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1542"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2025/03/CVE-2025-1542"
    },
    {
      "type": "WEB",
      "url": "https://www.oxari.com/en/product/oxari-servicedesk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-22WJ-5RV2-CQF6

Vulnerability from github – Published: 2023-04-24 18:30 – Updated: 2025-05-30 18:30
VLAI
Details

An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked.

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-26097"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-24T18:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be blocked.",
  "id": "GHSA-22wj-5rv2-cqf6",
  "modified": "2025-05-30T18:30:47Z",
  "published": "2023-04-24T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26097"
    },
    {
      "type": "WEB",
      "url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-26097"
    },
    {
      "type": "WEB",
      "url": "https://excellium-services.com/cert-xlm-advisory/CVE-2023-26097"
    },
    {
      "type": "WEB",
      "url": "https://www.telindus.lu/fr/produits/apsal"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-22WM-6R58-545P

Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-07-13 00:01
VLAI
Details

In the Microchip MiWi v6.5 software stack, there is a possibility of frame counters being being validated / updated prior to message authentication.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-37605"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-05T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "In the Microchip MiWi v6.5 software stack, there is a possibility of frame counters being being validated / updated prior to message authentication.",
  "id": "GHSA-22wm-6r58-545p",
  "modified": "2022-07-13T00:01:34Z",
  "published": "2022-05-24T19:10:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37605"
    },
    {
      "type": "WEB",
      "url": "https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.50.0.100-readme.pdf"
    },
    {
      "type": "WEB",
      "url": "https://ww1.microchip.com/downloads/en/DeviceDoc/asf-release-notes-3.51.0.101-readme.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.microchip.com/en-us/development-tools-tools-and-software/libraries-code-examples-and-more/advanced-software-framework-for-sam-devices#Downloads"
    },
    {
      "type": "WEB",
      "url": "https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/miwi-software-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://www.microchip.com/en-us/products/wireless-connectivity/sub-ghz/miwi-protocol"
    },
    {
      "type": "WEB",
      "url": "https://www.microchip.com/product-change-notifications/#"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list