Lack of Administrator Control over Security
CWE-671
The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used.
If the product's administrator does not have the ability to manage security-related decisions at all times, then protecting the product from outside threats - including the product's developer - can become impossible. For example, a hard-coded account name and password cannot be changed by the administrator, thus exposing that product to attacks that the administrator can not prevent.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
Latest Lack of Administrator Control over Security vulnerabilities
- 7.5 High severity
Guardian: Lack of Administrator Control over Security
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A man
- 8.1 High severity
Remote Collector: Lack of Administrator Control over Security
When the upstream Guardian or CMC was configured in the Remote Collector via n2os-tui, the generated configuration disabled TLS certificate verification, and no option was provided to enable it. A malicious actor could perform a man-in-the-middle attack and in
- 9.1 Critical severity
mjolnir: Lack of Administrator Control over Security
Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled.