CWE-425—Direct Request ('Forced Browsing')

Weakness Name

Direct Request ('Forced Browsing')

Description

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Common Consequences

Scope:

Confidentiality, Integrity, Availability, Access Control

Impact:

Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

Related Weaknesses

• CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')High
• CWE-288Authentication Bypass Using an Alternate Path or Channel
• CWE-424Improper Protection of Alternate Path
• CWE-471Modification of Assumed-Immutable Data (MAID)
• CWE-862Missing AuthorizationHigh