Authorization is the concept of allowing access to resources only to those who are permitted to use them. It is the process that comes after a successful authentication, so the user will, at this point, hold valid credentials associated with a well-defined set of roles and privileges. Vulnerabilities in this category involve the verification of roles and privileges. The user is allowed more access to the application or system than necessary to perform the task.
As an example of authorization with an ICS product gone wrong, consider the Moxa Device Server Web Console Authorization Bypass Vulnerability—ICSA-16-189-02 (https://ics-cert.us-cert.gov/advisories/ICSA-16-189-02). For the affected products, an attacker ...
