CWE-639

High likelihood

Authorization Bypass Through User-Controlled Key

Parent: CWE-863 - Incorrect Authorization

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

1,822 vulnerabilities with CWE-639
CVE-2023-49112 MEDIUM
Kiuwan SAST < master.1808.p685.q13371 - Authenticated Information Disclosure via Application Info Endpoint
CVSS 6.5
CVE-2023-40720 HIGH
FortiVoiceEnterprise <7.0.1, <=6.4.8 - Auth Bypass
CVSS 7.1
CVE-2023-6897 MEDIUM
EAN for WooCommerce <= 4.9.2 - Authenticated Insecure Direct Object Reference via alg_wc_ean_product_meta Shortcode
CVSS 4.3
CVE-2023-45808 MEDIUM
iTop < 2.7.10 - Authorization Bypass via Extkey Manipulation
CVSS 4.1
CVE-2023-51141 MEDIUM
ZKTeko BioTime <8.5.4 - Info Disclosure
CVSS 6.5
CVE-2023-6317 HIGH
secondscreen.gateway <7 - Privilege Escalation
CVSS 7.2
CVE-2023-6523 HIGH
ExtremePacs Extreme XDS <3914 - Auth Bypass
CVSS 8.8
CVE-2023-36483 MEDIUM
MASmobile Classic <1.16.18-1.7.24 - Auth Bypass
CVSS 6.5
CVE-2023-36238 MEDIUM
Bagisto 1.5.1 - Insecure Direct Object Reference via Invoice ID Parameter
CVSS 6.5
CVE-2023-6969 MEDIUM
User Shortcodes Plus <= 2.0.2 - Authenticated Insecure Direct Object Reference via User Meta Shortcode
CVSS 4.3
CVE-2023-7198 MEDIUM
WP Dashboard Notes < 1.0.11 - Authenticated Insecure Direct Object Reference via post_id Parameter
CVSS 4.3
CVE-2023-49339 MEDIUM
Ellucian Banner 9.17 - Info Disclosure
CVSS 6.5
CVE-2023-6724 HIGH
Hearing Tracking System < 7.0 for iOS and < 1.0 for Android - Authentication Abuse via User-Controlled Key
CVSS 8.8
CVE-2023-6515 HIGH
Mia Technology Inc. MA-MED < 1.0.7 - Authentication Abuse via User-Controlled Key
CVSS 8.8
CVE-2023-47022 MEDIUM
NCR Terminal Handler <1.5.1 - Info Disclosure
CVSS 6.5
CVE-2023-6983 MEDIUM
Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference via vg_display_data Shortcode
CVSS 4.3
CVE-2023-7199 MEDIUM
Relevanssi < 4.22.0 and Relevanssi Premium < 2.25.0 - Unauthenticated Authorization Bypass via Crafted Request
CVSS 5.3
CVE-2023-6384 MEDIUM
WP User Profile Avatar <1.0.1 - Auth Bypass
CVSS 4.3
CVE-2023-7031 MEDIUM
Avaya Aura Experience Portal 8.0.0-8.1.2.0.0402 - Authenticated Insecure Direct Object Reference
CVSS 5.7
CVE-2023-36235 MEDIUM
Webkul QloApps <1.6.0 - Info Disclosure
CVSS 6.5
CVE-2023-6824 MEDIUM
WP Customer Area < 8.2.1 - Unauthenticated User Data Exposure via AJAX Action Capability Bypass
CVSS 6.5
CVE-2023-6875 CRITICAL
Wordpress POST SMTP Account Takeover
CVSS 9.8
CVE-2023-6504 MEDIUM
User Profile Builder <3.10.7 - Info Disclosure
CVSS 4.3
CVE-2023-6506 MEDIUM
WP 2FA - Insecure Direct Object Reference
CVSS 4.3
CVE-2023-6223 MEDIUM
LearnPress <4.2.5.7 - Info Disclosure
CVSS 4.3
Details
Vulnerabilities 1,822
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits