Weakness (CWE)
CWE-602: Client-Side Enforcement of Server-Side Security
The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
How to prevent it (2 mitigations)
-
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.
-
Architecture and Design
If some degree of trust is required between the two entities, then use integrity checking and strong authentication to ensure that the inputs are coming from a trusted source. Design the product so that this trust is managed in a centralized fashion, especially if there are complex or numerous communication channels, in order to reduce the risks that the implementer will mistakenly omit a check in a single code path.
Source: MITRE CWE-602
192 results · Feed
-
Medium 5.5
IBM SmartCloud Analytics - Log Analysis security bypass
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
-
Medium 5.5
IBM SmartCloud Analytics - Log Analysis security bypass
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
-
Medium 6.7
An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with …
-
Medium 5.3
IBM OpenPages with Watson improper input validation
IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the serve…
-
Medium 6.3
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Iv…
-
High 7.7
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Medium 5.3
Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of req…
-
Medium 6.5
Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated …
-
High 7.1
IBM Aspera Faspex data modification
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
-
High 7.1
Cisco Unified Intelligence Center Privilege Escalation Vulnerability
A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due to insufficient server-side validation of…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Critical 9.9
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versi…
-
Low 3.7
Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security
A security flaw has been discovered in Dígitro NGC Explorer up to 3.48.21. The impacted element is an unknown function of the component Password Transmission Handler. Performing a manipulation results in client-side enforcement of server-side security. The at…
-
Medium 6.2
Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability…
-
Medium 6.4
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs b…
-
Medium 6.5
IBM Cloud Pak for Business Automation denial of service
IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user interface which could cause a denial of service.
-
High 8.2
Captcha Bypass Vulnerability in Meon KYC solutions
This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to by…
-
High 7.7
W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into …
-
Medium 4.8
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor …
-
Medium 4.2
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0…
-
High 8.1
An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorize…
-
Critical 9.8
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inte…
-
Medium 6.5
IBM Robotic Process Automation security bypass
IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a priv…
-
Medium 5.8
Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, an…
-
Critical 9.8CVE-2024-12603 Public exploit
A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application passw…
-
High 7.1
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows…
-
Low 2.0
Password Policy Bypass Vulnerability in Fides Webserver
Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password c…
-
Medium 4.4
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove vi…
-
High 7.1CVE-2024-23666 Public exploit
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 th…
-
Medium 4.3
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific file management functions. This vulnerability is due to lack of server-side validation of Admi…
-
Medium 4.9
IBM Business Automation Workflow improper input validation
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation.
-
High 8.8
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.…
-
High 8.3
CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security
-
Low 3.5
Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerabili…
-
Medium 6.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application…
-
Medium 4.1
A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker …
-
Medium 5.3
WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability
Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.
-
Medium 5.3
WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerability
Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.
-
Medium 5.3
WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability
Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.