CWE-425—Direct Request ('Forced Browsing')

名称

Direct Request ('Forced Browsing')

描述

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

常见后果

范围：

Confidentiality, Integrity, Availability, Access Control

影响：

Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

相关 CWE

• CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')High
• CWE-288Authentication Bypass Using an Alternate Path or Channel
• CWE-424Improper Protection of Alternate Path
• CWE-471Modification of Assumed-Immutable Data (MAID)
• CWE-862Missing AuthorizationHigh