cve.bz

CAPEC-87

Forceful Browsing

High severityHigh likelihoodStandard pattern

An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-87: Forceful Browsing: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/87.html and https://cve.bz/cve/capec/87?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Spider] Using an automated tool, an attacker follows all public links on a web site. They record all the links they find.

      2 techniques
      • Use a spidering tool to follow and record all links.
      • Use a proxy tool to record all links visited during a manual traversal of the web application.

  2. Experiment

    They probe what they found.

    1. [Attempt well-known or guessable resource locations] Using an automated tool, an attacker requests a variety of well-known URLs that correspond to administrative, debugging, or other useful internal actions. They record all the positive responses from the server.

      2 techniques
      • Use a spidering tool to follow and record attempts on well-known URLs.
      • Use a proxy tool to record all links visited during a manual traversal of attempts on well-known URLs.

  3. Exploit

    They carry out the attack.

    1. [Use unauthorized resources] By visiting the unprotected resource, the attacker makes use of unauthorized functionality.

      1 technique
      • Access unprotected functions and execute them.

    2. [View unauthorized data] The attacker discovers and views unprotected sensitive data.

      1 technique
      • Direct request of protected pages that directly access database back-ends. (e.g., list.jsp, accounts.jsp, status.jsp, etc.)

Prerequisites

  • The forcibly browseable pages or accessible resources must be discoverable and improperly protected.

Skills required

  • Low skill

    Forcibly browseable pages can be discovered by using a number of automated tools. Doing the same manually is tedious but by no means difficult.

Resources required

  • None: No specialized resources are required to execute this type of attack. A directory listing is helpful, but not a requirement.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Read DataConfidentiality
Bypass Protection MechanismConfidentiality, Access Control, Authorization

Mitigations

  • Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context.

  • Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.

Weaknesses it exploits

Recent CVEs with these weaknesses

  1. 2.1CVE-2026-124621

    A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Bo…

  2. 5.5CVE-2026-124590

    A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/c…

  3. –CVE-2026-123779

    Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd fil…

  4. 5.3CVE-2026-113702

    A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The man…

  5. –CVE-2026-40913

    Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG …

  6. 2.1CVE-2026-124574

    A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipula…

  7. 4.3CVE-2026-19307

    IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to acce…

  8. 8.1CVE-2026-19133

    IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.

The newest records naming one of them. Each weakness's page lists them all.

Part of

Examples

A bulletin board application provides an administrative interface at admin.aspx when the user logging in belo…

A bulletin board application provides an administrative interface at admin.aspx when the user logging in belongs to the administrators group.

An attacker can access the admin.aspx interface by making a direct request to the page. Not having access to the interface appropriately protected allows the attacker to perform administrative functions without having to authenticate themself in that role.

MITRE's words, unchanged: CAPEC-87 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.