CWE-425
Direct Request ('Forced Browsing')
About
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Common consequences
- Confidentiality, Integrity, Availability, Access Control → Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity
Mitigations
- Architecture and Design, Operation: Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
- Architecture and Design: Consider using MVC based frameworks such as Struts.
CVEs with this weakness
Frequently asked questions
What is CWE-425?
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. Common consequences Confidentiality, Integrity, Availability, Access Control → Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity Mitigations Architecture and Design, Operation: Apply appropriate access control authorizations for ea…
Which platforms does CWE-425 affect?
CWE-425 has been observed on: Web Based, Web Server.
How many CVEs does Rainforest track for CWE-425?
Rainforest Labs currently tracks 1 published CVEs mapped to CWE-425. They are listed on this page.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.