682
Nature Type ID Name Page
ParentOf 287 Improper Authentication 692
ParentOf 288 Authentication Bypass Using an Alternate Path or Channel 700
ParentOf 639 Authorization Bypass Through User-Controlled Key 1406
ParentOf 862 Missing Authorization 1780
ParentOf 863 Incorrect Authorization 1787
Applicable Platforms
Technology : Not Technology-Specific (Prevalence = Undetermined)
Technology : ICS/OT (Prevalence = Undetermined)
Alternate Terms
Authorization : The terms "access control" and "authorization" are often used interchangeably,
although many people have distinct definitions. The CWE usage of "access control" is intended as
a general term for the various mechanisms that restrict which users can access which resources,
and "authorization" is more narrowly defined. It is unlikely that there will be community consensus
on the use of these terms.
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage
trust zones in the software.
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Observed Examples
Reference Description
CVE-2022-24985 A form hosting website only checks the session authentication status for
a single form, making it possible to bypass authentication when there are
multiple forms
https://www.cve.org/CVERecord?id=CVE-2022-24985
CVE-2022-29238 Access-control setting in web-based document collaboration tool is not
properly implemented by the code, which prevents listing hidden directories but
does not prevent direct requests to files in those directories.
https://www.cve.org/CVERecord?id=CVE-2022-29238
CVE-2022-23607 Python-based HTTP library did not scope cookies to a particular domain such
that "supercookies" could be sent to any domain on redirect
https://www.cve.org/CVERecord?id=CVE-2022-23607
CVE-2021-21972 Chain: Cloud computing virtualization platform does not require authentication
for upload of a tar format file (CWE-306), then uses .. path traversal sequences
CWE Version 4.14
CWE-284: Improper Access Control
CWE-284: Improper Access Control