1791
}
}
if ($role == 'Reader') {
DisplayMedicalHistory($_POST['patient_ID']);
}
else{
die("You are not Authorized to view this record\n");
}
The programmer expects that the cookie will only be set when getRole() succeeds. The
programmer even diligently specifies a 2-hour expiration for the cookie. However, the attacker can
easily set the "role" cookie to the value "Reader". As a result, the $role variable is "Reader", and
getRole() is never invoked. The attacker has bypassed the authorization system.
Observed Examples
Reference Description
CVE-2021-39155 Chain: A microservice integration and management platform compares the
hostname in the HTTP Host header in a case-sensitive way (CWE-178,
CWE-1289), allowing bypass of the authorization policy (CWE-863) using a
hostname with mixed case or other variations.
https://www.cve.org/CVERecord?id=CVE-2021-39155
CVE-2019-15900 Chain: sscanf() call is used to check if a username and group exists, but the
return value of sscanf() call is not checked (CWE-252), causing an uninitialized
variable to be checked (CWE-457), returning success to allow authorization
bypass for executing a privileged (CWE-863).
https://www.cve.org/CVERecord?id=CVE-2019-15900
CVE-2009-2213 Gateway uses default "Allow" configuration for its authorization settings.
https://www.cve.org/CVERecord?id=CVE-2009-2213
CVE-2009-0034 Chain: product does not properly interpret a configuration option for a system
group, allowing users to gain privileges.
https://www.cve.org/CVERecord?id=CVE-2009-0034
CVE-2008-6123 Chain: SNMP product does not properly parse a configuration option for which
hosts are allowed to connect, allowing unauthorized IP addresses to connect.
https://www.cve.org/CVERecord?id=CVE-2008-6123
CVE-2008-7109 Chain: reliance on client-side security (CWE-602) allows attackers to bypass
authorization using a custom client.
https://www.cve.org/CVERecord?id=CVE-2008-7109
CVE-2008-3424 Chain: product does not properly handle wildcards in an authorization policy
list, allowing unintended access.
https://www.cve.org/CVERecord?id=CVE-2008-3424
CVE-2008-4577 ACL-based protection mechanism treats negative access rights as if they are
positive, allowing bypass of intended restrictions.
https://www.cve.org/CVERecord?id=CVE-2008-4577
CVE-2006-6679 Product relies on the X-Forwarded-For HTTP header for authorization, allowing
unintended access by spoofing the header.
https://www.cve.org/CVERecord?id=CVE-2006-6679
CVE-2005-2801 Chain: file-system code performs an incorrect comparison (CWE-697),
preventing default ACLs from being properly applied.
https://www.cve.org/CVERecord?id=CVE-2005-2801
CVE-2001-1155 Chain: product does not properly check the result of a reverse DNS lookup
because of operator precedence (CWE-783), allowing bypass of DNS-based
access restrictions.
https://www.cve.org/CVERecord?id=CVE-2001-1155
MemberOf Relationships
CWE Version 4.14
CWE-908: Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource