Missing Authentication for Critical Functionality
CWE-306
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
We track 2,227 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 54 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator.
- Implementation System Configuration Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data.
Latest Missing Authentication for Critical Functionality vulnerabilities
- 9.8 Critical severity
Security Optimizer – The All-In-One Protection…: Missing Authentication for Critical Functionality
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized user
- 9.8 Critical severity
garden: Missing Authentication for Critical Functionality
Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The conf
- 7.3 High severity
SAP Information System: Missing Authentication for Critical Functionality
A vulnerability was found in SAP Information System 1.0 which has been rated as critical. Affected by this issue is the file /SAP_Information_System/controllers/add_admin.php. An unauthenticated attacker is able to create a new admin account for the web applic
- 9.8 Critical severity
Veeam Backup & Replication Remote Code Execution Exploited
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
- 9.8 Critical severity
Axeda agent: Missing Authentication for Critical Functionality
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability
- 7.5 High severity
Axeda agent: Missing Authentication for Critical Functionality
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allo
- 9.8 Critical severity
Axeda agent: Missing Authentication for Critical Functionality
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker
- 7.5 High severity
Freetakserver-ui: Missing Authentication for Critical Functionality
An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users.
- 9.8 Critical severity
MiCollab, MiVoice Business Express Access Control Exploited
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). Th
- 9.1 Critical severity
PLC4TRUCKS: Missing Authentication for Critical Functionality
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
- 7.8 High severity
SAP Focused Run (Simple Diagnostics Agent): Missing Authentication for Critical Functionality
The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative o
- 7.8 High severity
Usbview: Missing Authentication for Critical Functionality
USBView 2.1 before 2.2 allows some local users (e.g., ones logged in via SSH) to execute arbitrary code as root because certain Polkit settings (e.g., allow_any=yes) for pkexec disable the authentication requirement. Code execution can, for example, use the --
- 7.5 High severity
Oracle Fusion Middleware Unspecified Exploited
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with net
- 9.8 Critical severity
NUUO NVRmini2 Devices Missing Authentication Exploited
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is po
- 9.8 Critical severity
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts
- 9.8 Critical severity
Zoho ManageEngine ServiceDesk Authentication Bypass Exploited
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
- 8.5 High severity
XStream Remote Code Execution Exploited
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affect
- 9.8 Critical severity
SolarWinds Orion Authentication Bypass Exploited
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise o
- 9.8 Critical severity
Apache Airflow's Experimental API Authentication Bypass Exploited
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and i
- 8.8 High severity
TP-link TL-WA855RE Missing Authentication for Critical Function Exploited
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative pa
- 6.5 Medium severity
Fortinet FortiOS Default Configuration Exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- 10.0 Critical severity
SAP NetWeaver Missing Authentication for Critical Function Exploited
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java s
- 9.8 Critical severity
VMware vCenter Server Information Disclosure Exploited
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
- 9.8 Critical severity
SAP Solution Manager Missing Authentication for Critical Function Exploited
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
- 8.8 High severity
ThinkPHP Remote Code Execution Exploited
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
- 7.5 High severity
Oracle Corporation WebLogic Server Remote Code Execution Exploited
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated
- 10.0 Critical severity
SAP NetWeaver Remote Code Execution Exploited
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, a