CWE-636: Not Failing Securely
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Also known as Failing Open.
A kind of CWE-657 Violation of Secure Design Principles.
From the CWE List. © The MITRE Corporation.
Newest
- jopenlibs vault-java-driver vault-java-driver: SslConfig silently disables requested TLS verification 7.4 High
- sandboxie-plus sandboxie Sandboxie-Plus: Sandbox containment bypass 6.9 Medium
- node-opcua node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 9.1 Critical
- sonicwall global management system (gms) An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions... 9.1 Critical
- apache software foundation kafka Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured 9.1 Critical
- veeam backup and replication A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP... 9.1 Critical
- apache software foundation pulsar Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization 2.3 Low
- progressive robot ltd hmailserver Not Failing Securely ('Failing Open') in hMailServer 5.8 Medium
- apache software foundation tomcat Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up 6.5 Medium
- hexpm hex core hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 5.9 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not... 6.8 Medium
- sumatrapdfreader sumatrapdf SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization) 5.4 Medium
- docker sandboxes Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials 5.9 Medium
- progressive robot ltd hmailserver Not Failing Securely ('Failing Open') in hMailServer 7.4 High
- pgjdbc pgjdbc does not enforce requireAuth when the value excludes every authentication method 5.9 Medium
- perforce p4 (helix core) Authentication bypass via blank auth token in P4Search 9.5 Critical
- heymrun heym heym before 0.0.105 Authentication Bypass via Redis Node 6.8 Medium
- tduckcloud tduck-survey-form TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check 6.0 Medium
- bytebase dbhub @bytebase/dbhub's read-only mode does not prevent database writes 7.4 High
- red hat hardened images Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths 5.3 Medium
- moquette Moquette fails open when configured authentication or authorization classes cannot load 9.3 Critical
- moquette Moquette client IDs can cause cross-session H2 durable-queue corruption 8.8 High
- moquette Moquette publishes Last-Will messages without enforcing write authorization 8.7 High
- moquette Moquette unbounded per-session message queues allow memory exhaustion 8.7 High
- moquette Moquette deeply nested MQTT topics can cause stack exhaustion 8.7 High
- moquette Moquette malformed shared subscriptions can crash command processing 8.7 High
- moquette Moquette uncaught MQTT command exceptions can terminate shared session event loops 8.7 High
- moquette Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass 9.6 Critical
- watchguard authentication gateway, authpoint authentication gateway +1 more AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass 7.4 High
- steveiliop56 tinyauth Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for 8.1 High
- craftcms cms Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer 8.2 High
- djust-org djust djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data 7.7 High
- maziggy bambuddy Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints 9.3 Critical
- doyensec safeurl SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts 9.0 Critical
- microsoft visual studio code Visual Studio Code Security Feature Bypass Vulnerability 8.2 High
- apitable APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard 5.3 Medium
- chewkeanho software-actualizer (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The i… 7.9 High
- f5 nginx javascript NGINX ngx_http_js_module vulnerability 8.8 High
- ash-project ash Ash.Reactor change step fails open, skipping a change when its where guard raises 2.1 Low
- igel os 11, os 12 +1 more IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File 6.8 Medium
-
aiirPyPI AIIR verification and policy gates could report success without enforcing the control (fail-open) 6.9 Medium - mybb MyBB: Security Question insufficient validation 5.3 Medium
- rsyncproject rsync rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure 9.1 Critical
- microsoft visual studio code Visual Studio Code Security Feature Bypass Vulnerability 8.2 High
- livebook Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access 7.7 High
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 more Fallback to second RAUC slot with default credentials 8.3 High
-
nono-clicrates.io nono-cli'scregistry pack verification can fail open when provenance metadata is absent 6.6 Medium - nextauthjs next-auth NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) 9.1 Critical
- jupyterlab JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager 7.7 High
- getgrav grav-plugin-flex-objects Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny) 6.3 Medium
- Show olderLoading…