DerScanner
Home / Vulnerability Database / 1C : Unsafe database access control
1C

1C : Unsafe database access control

Classification

OWASP Top 10 2013
A1-InjectionA4-Insecure Direct Object ReferencesA7-Missing Function Level Access Control
OWASP Top 10 2017
A1-InjectionA5-Broken Access Control
OWASP Top 10 2021
A3-InjectionA1-Broken Access Control
OWASP ASVS
Access ControlAccess ControlAccess ControlAccess ControlAuthenticationAuthenticationAuthentication
PCI DSS 4.0
6.2.47.2.6
HIPAA
§164.312 (a)(1)§164.312 (d)
CWE
CWE-284CWE-287CWE-306CWE-862CWE-1027CWE-1030CWE-1033
CWE/SANS Top 25 2011
CWE-306CWE-862
CWE/SANS Top 25 2021
CWE-287CWE-306CWE-862

Overview

The application refers to the SavedPasswordValue property, which contains the stored password value (hash functions). Knowing the user’s password, an attacker can gain unauthorized access to the system.

References

  1. OWASP Top 10 2017-A5-Broken Access Control
  2. OWASP Top 10 2013-A4-Insecure Direct Object References
  3. CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
  4. CWE-863: Incorrect Authorization
  5. CWE-284
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
  7. CWE-1030
LOW

DerScanner Severity Score

Do you want to fix 1C : Unsafe database access control in your application?

See also

1C

1C : Null encryption key

1C

1C : Memory leak

1C

1C : Empty encryption key