|
|
|
|
CWE-425 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 425 (Weakness Base) | | Description | Summary The web application fails to adequately enforce appropriate authorization on all restricted URLs, scripts or files. Such web applications often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path. | | Potential Mitigations | Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files. | | Observed Examples | | | Context Notes | Terminology Note: the "forced browsing" term could be misinterpreted to include
weaknesses such as CSRF or XSS, so its use is discouraged. "Forced browsing" is a step-based manipulation involving the omission of one or more
steps, whose order is assumed to be immutable; the application does not verify that the first step
was performed. The consequence is typically "authentication bypass" or "path disclosure," although
it can expose all kinds of weaknesses, especially in languages such as PHP, which allow external
modification of assumed-immutable variables. overlaps Modification of Assumed-Immutable Data
(MAID), authorization errors, container errors; often primary to other
weaknesses such as XSS and SQL injection. | | Relationships | | | Source Taxonomies | PLOVER - Direct Request aka 'Forced Browsing | | Applicable Platforms | All | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 87 | Forceful Browsing |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
