Weakness (CWE)
CWE-424: Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
How to prevent it (1 mitigation)
-
Architecture and Design
Deploy different layers of protection to implement security in depth.
Source: MITRE CWE-424
25 results · Clear filters · Feed
-
Medium 5.0
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nod…
-
Medium 6.5
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the Pages API's api.pages.read/write permissions or p…
-
Medium 5.5
Windows AppX Deployment Service Security Feature Bypass Vulnerability
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.
-
Medium 6.5
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that u…
-
Medium 6.3
ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scoped to the canonical prefix. oauth2_server_protocol_routes/1 i…
-
Medium 6.5
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
-
Medium 6.9
Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false
Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue.
-
Medium 4.4
Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux
A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.
-
Medium 5.7
Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker …
-
Medium 5.5
AWS API MCP File Access Restriction Bypass
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in th…
-
Medium 4.3
Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacke…
-
Medium 6.4
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a…
-
Medium 6.7
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip…
-
Medium 4.9
CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can b…
-
Medium 4.9
CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScr…
-
Medium 5.3
Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs tra…
-
Medium 6.5
Improper Protection of Alternate Path in GitLab
An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.
-
Medium 5.3
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not pro…
-
Medium 6.7
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, r…
-
Medium 6.7
IBM MQ privilege escalation
IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID: 269535.
-
Medium 6.8
2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424
The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an attacker to directly access the operating system. An attacker could leverage this vulnerability to escalate privileges on a device and/or in…
-
Medium 4.6
Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to…
-
Medium 4.2
Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows phys…
-
Medium 6.5
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allo…
-
Medium 4.3
PB610 HMISimulator provides interface with access to arbitrary files
The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working dire…