CWE•Base•Incomplete•20 recent CVEs

CWE-425Direct Request ('Forced Browsing')

Description

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Common consequences

Confidentiality,Integrity,Availability,Access Control→Read Application Data,Modify Application Data,Execute Unauthorized Code or Commands,Gain Privileges or Assume Identity

Potential mitigations

Architecture and Design,Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Architecture and Design
Consider using MVC based frameworks such as Struts.

Related CWEs

CWE-862Missing Authorization CWE-862Missing Authorization CWE-288Authentication Bypass Using an Alternate Path or Channel CWE-424Improper Protection of Alternate Path CWE-471Modification of Assumed-Immutable Data (MAID)CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Recent CVEs classified under this CWE