CWE-639

High likelihood

Authorization Bypass Through User-Controlled Key

Parent: CWE-863 - Incorrect Authorization

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

1,830 vulnerabilities with CWE-639
CVE-2019-13360 CRITICAL
Webpanel - Insecure Direct Object Reference
CVSS 9.8
CVE-2019-13337 HIGH
WESEEK GROWI < 3.5.0 - Unauthenticated Authorization Bypass via access_token URL Parameter
CVSS 7.5
CVE-2019-13461 HIGH
PrestaShop < 1.7.6.0 RC2 - Insecure Direct Object Reference via Checkout Address Parameters
CVSS 7.5
CVE-2019-12782 HIGH
ThoughtSpot 4.4.1-5.1.1 - Authorization Bypass via Pinboard GUID Spoofing
CVSS 8.1
CVE-2019-5966 MEDIUM
Joruri Mail < 2.1.4 - Session Impersonation and Information Disclosure
CVSS 5.4
CVE-2019-12866 CRITICAL
JetBrains YouTrack < 2018.4.49168 - Authorization Bypass via User-Controlled Key
CVSS 9.8
CVE-2019-12742 HIGH
Bludit < 3.9.1 - Unauthenticated Password Change via Insecure Direct Object Reference
CVSS 8.8
CVE-2019-12252 MEDIUM
Zoho ManageEngine ServiceDesk Plus <10.5 - Info Disclosure
CVSS 6.5
CVE-2019-10108 MEDIUM
GitLab < 11.7.8, 11.8.x < 11.8.4, 11.9.x < 11.9.2 - Incorrect Access Control for Private Project Labels
CVSS 5.4
CVE-2019-9756 CRITICAL
GitLab Community and Enterprise Edition <11.6.10/11.7.6 - Incorrect Access Control
CVSS 9.8
CVE-2019-9219 LOW
GitLab < 11.6.10, 11.7.x < 11.7.6, 11.8.x < 11.8.1 - Authorization Bypass Through User-Controlled Key
CVSS 3.7
CVE-2019-9170 MEDIUM
GitLab < 11.6.10, 11.7.x < 11.7.6, 11.8.x < 11.8.1 - Incorrect Access Control
CVSS 5.3
CVE-2019-9921 MEDIUM
Harmis JE Messenger 1.2.2 - Info Disclosure
CVSS 6.5
CVE-2019-9938 MEDIUM
SHAREit < 4.0.42 - Unauthenticated Arbitrary File Download via Network Access
CVSS 5.3
CVE-2019-6716 CRITICAL
Nervepoint Access Manager 2013-2017 - Unauthenticated IDOR via runJob.html jobId
CVSS 9.4
CVE-2018-25270 CRITICAL
ThinkPHP 5.0.23 Remote Code Execution via invokefunction
CVSS 9.8
CVE-2018-25129 HIGH
SOCA Access Control System 180612 - Info Disclosure
CVSS 7.5
CVE-2018-17455 HIGH
GitLab EE <11.1.7, <11.2.4, <11.3.1 - Info Disclosure
CVSS 7.5
CVE-2018-17449 HIGH
GitLab <11.1.7-11.3.1 - Info Disclosure
CVSS 7.5
CVE-2018-19584 HIGH
GitLab EE <11.3.11-11.5.1 - Info Disclosure
CVSS 7.5
CVE-2018-19582 MEDIUM
GitLab EE <11.4.8-11.5.1 - Info Disclosure
CVSS 4.3
CVE-2018-19575 MEDIUM
GitLab CE/EE <11.3.11-11.5.1 - Info Disclosure
CVSS 4.3
CVE-2018-18976 MEDIUM
Ascensia Contour Diabetes < 2.4.30 and < 2.5.0 - Unauthenticated Insecure Direct Object Reference
CVSS 5.3
CVE-2018-20405 LOW
BigTree 4.3 - Authenticated Path Disclosure via Admin News Input
CVSS 2.7
CVE-2018-16971 MEDIUM
Wisetail Learning Ecosystem <4.11.6 - IDOR
CVSS 4.3
Details
Vulnerabilities 1,830
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits