683
Reference Description
(CWE-23) in the file to access unexpected files, as exploited in the wild per
CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21972
CVE-2021-37415 IT management product does not perform authentication for some REST API
requests, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-37415
CVE-2021-35033 Firmware for a WiFi router uses a hard-coded password for a BusyBox shell,
allowing bypass of authentication through the UART port
https://www.cve.org/CVERecord?id=CVE-2021-35033
CVE-2020-10263 Bluetooth speaker does not require authentication for the debug functionality
on the UART port, allowing root shell access
https://www.cve.org/CVERecord?id=CVE-2020-10263
CVE-2020-13927 Default setting in workflow management product allows all API requests
without authentication, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-13927
CVE-2010-4624 Bulletin board applies restrictions on number of images during post creation,
but does not enforce this on editing.
https://www.cve.org/CVERecord?id=CVE-2010-4624
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 254 7PK - Security Features 700 2314
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 944 SFP Secondary Cluster: Access Management 888 2393
MemberOf 1031 OWASP Top Ten 2017 Category A5 - Broken Access
Control
1026 2437
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1369 ICS Supply Chain: IT/OT Convergence/Expansion 1358 2506
MemberOf 1372 ICS Supply Chain: OT Counterfeit and Malicious
Corruption
1358 2509
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Maintenance
This entry needs more work. Possible sub-categories include: Trusted group includes undesired
entities (partially covered by CWE-286) Group can perform undesired actions ACL parse error
does not fail closed
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Access Control List (ACL) errors
WASC 2 Insufficient Authorization
7 Pernicious Kingdoms Missing Access Control
CWE Version 4.14
CWE-285: Improper Authorization
CWE-285: Improper Authorization