CWE-284: Improper Access Control

Access control is a broader set of mechanisms covering authentication, authorization, and accountability. A weakness can arise when identity is not adequately established, when permissions do not match the intended policy, or when security-relevant activity is not tracked. The record distinguishes two principal causes: specification, where permissions, ownership, or privileges are configured incorrectly, and enforcement, where implementation errors prevent the product from applying the administrator's intended policy. Examples include granting excessive privileges, allowing users to define their own privileges, or interpreting an invalid access-control list in an insecure way.

This is a broad, context-dependent weakness that may occur in language-independent and technology-independent products, including web-based and ICS/OT systems. It may be introduced during architecture and design, implementation, or operation. The record also notes that “access control” is used broadly for mechanisms restricting which users can access which resources, while “authorization” may be used more narrowly.

The consequence varies by context. Depending on the resource and the failed control, an unauthorized actor may gain privileges, read sensitive information, execute commands, or evade detection. The official consequence classification is Other: Varies by Context.

Manage privileges and trust zones: Carefully control how privileges are set, managed, and handled, and explicitly define trust zones in the software. Use compartmentalization and least privilege: During architecture and design, separate the system into safe areas with clear trust boundaries, keep sensitive data within the appropriate boundary, and treat interfaces with outside compartments cautiously. Build compartmentalization into the design so it supports privilege separation, and grant privileges only when needed before dropping them when they are no longer required.

The official record does not specify detection methods.

The following are representative examples from the official record, not a complete list:

• CVE-2023-26463: An IPSec VPN product reused one variable for multiple purposes, contributing to incorrect access control along with an expired-pointer dereference.
• CVE-2022-24985: A form-hosting website checked session authentication for only one form, allowing authentication bypass when multiple forms were present.
• CVE-2022-29238: A web-based document collaboration tool prevented listing hidden directories but still allowed direct requests for files within them.
• CVE-2022-23607: A Python HTTP library failed to scope cookies to a particular domain, allowing cookies to be sent to any domain after a redirect.
• CVE-2021-21972: A virtualization platform did not require authentication to upload a tar file, which could then use path traversal to access unexpected files; the record states it was exploited in the wild.
• CVE-2021-37415: An IT management product did not authenticate some REST API requests; the record states it was exploited in the wild.
• CVE-2021-35033: WiFi-router firmware used a hard-coded password for a BusyBox shell, enabling authentication bypass through the UART port.
• CVE-2020-10263: A Bluetooth speaker exposed debug functionality through the UART port without authentication, allowing root-shell access.
• CVE-2020-13927: A default setting in a workflow-management product allowed all API requests without authentication; the record states it was exploited in the wild.
• CVE-2010-4624: A bulletin board enforced an image-count restriction when creating a post but not when editing it.