CWE-425

Base Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Incomplete MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE
Direct Request ('Forced Browsing')

Description

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Top Monitored CVEs

CVE-2024-45195
HIGH KEV
7.5 100.0%
2024-09-04
CVE-2021-26085
MEDIUM KEV
5.3 99.9%
2021-08-03
CVE-2024-0204
CRITICAL
9.8 95.1%
2024-01-22
CVE-2020-35391
MEDIUM
6.5 35.0%
2021-01-01

Consequences

Confidentiality, Integrity, Availability, Access Control — Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

Mitigations

Phase: Architecture and Design, Operation

Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

Phase: Architecture and Design

Consider using MVC based frameworks such as Struts.