Skip to content
OpenAdvisories

Weakness (CWE)

CWE-425: Direct Request

Base Incomplete

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

  2. Architecture and Design

    Consider using MVC based frameworks such as Struts.

Source: MITRE CWE-425

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-45195 Exploited Public exploit EPSS 100%

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Feb 4, 2025
  • Medium 5.3
    CVE-2021-26085 Exploited · Ransomware Public exploit EPSS 100%

    Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Mar 28, 2022