Skip to content
OpenAdvisories

Weakness (CWE)

CWE-425: Direct Request

Base Incomplete

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

How to prevent it (2 mitigations)

  1. Architecture and Design, Operation

    Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

  2. Architecture and Design

    Consider using MVC based frameworks such as Struts.

Source: MITRE CWE-425

All Critical High Medium Low Exploited only Public exploit

85 results · Clear filters · Feed

  • Medium 5.3
    CVE-2016-1000111

    Forced Browsing in Twisted

    Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers…

    twisted twisted twisted py3-twisted Debian Ubuntu Alpine PyPI
  • Medium 4.3
    CVE-2019-10354

    Missing Authorization in Jenkins

    A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core org.kohsuke.stapler:stapler-parent Web / CMS Maven
  • Medium 4.3
    CVE-2018-19620

    Showdoc Unauthenticated Access

    ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.

    showdoc/showdoc Packagist
  • Medium 5.3
    CVE-2004-2257

    phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via…

  • Medium 5.3
    CVE-2005-1688

    Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) …

    wordpress Debian