CVE-2023-37492

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.

Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.

Mandates authorization checks before permitting access or data processing via external systems.

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

A.5.18's provisioning, revocation, review and adjustment of access rights (incl. before role changes/termination, with segregation and owner approval) directly stops incorrect authorization decisions from being exploitable in the vast majority of cases; the bounded remainder is incorrectness inside the authorization logic itself (e.g. flawed conditional or missing check) rather than rights that were wrongly granted.

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.

A.5.8 integrates risk assessment, requirements elicitation and governance into the project lifecycle so that authorization needs can be identified and specified; it does not itself perform or enforce authorization checks, so the missing-authorization weakness can still be present and exploitable.

Security checkpoints and explicit authorization requirements in the design phase ensure that every sensitive function is paired with an access-control check, reducing missing-authorization defects.

A.8.27 mandates security-by-design principles (least privilege, default deny, security architecture integration, zero-trust never-trust/always-verify, dynamic access control) plus design reviews that directly specify and enforce authorization checks before access; this stops most missing-authorization cases from being exploitable, with a bounded remainder in non-architectural or legacy components where the principles were documented but not fully applied.