cve.bz

CWE-425: Direct Request (Forced Browsing), page 3

Filter

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

What the weakness is: CWE-425 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-87 Forceful Browsing Likelihood: High · Severity: High
  • CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
  • CAPEC-143 Detect Unpublicized Web Pages Severity: Low
  • CAPEC-144 Detect Unpublicized Web Services Severity: Low
  • CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB) Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-425, as MITRE names them. Credits.

Ask an AI about CWE-425

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-425: Direct Request and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/425.html and https://cve.bz/cve/cwe/425?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2023-3426EPSS 0.6%

    The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.

  2. 6.5CVE-2023-3792EPSS 0.7%

    A vulnerability was found in Beijing Netcon NS-ASG 6.3. It has been classified as problematic. This affects an unknown part of the file /admin/test_status.php. The manipulation leads to direct request. The exploit has been disclosed to the…

  3. 6.5CVE-2015-1313EPSS 0.6%

    JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after a…

  4. 4.3CVE-2023-22834EPSS 0.4%

    The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to clutter up Compass folders with extraneous analyses, that the attacker would otherwise not have permi…

  5. 6.5CVE-2023-28160EPSS 0.5%

    When following a redirect to a publicly accessible web extension file, the URL may have been translated to the actual local path, leaking potentially sensitive information. This vulnerability affects Firefox < 111.

  6. 9.8CVE-2023-2524EPSS 0.4%

    A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/#/. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated i…

  7. 9.8CVE-2023-1699EPSS 0.4%

    Rapid7 Nexpose versions 6.6.186 and below suffer from a forced browsing vulnerability.  This vulnerability allows an attacker to manipulate URLs to forcefully browse to and access administrative pages. This vulnerability is fixed in versio…

  8. 5.3CVE-2023-1663EPSS 0.4%

    Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache…

  9. 7.5CVE-2023-1682EPSS 0.7%

    A vulnerability has been found in Xunrui CMS 4.61 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dayrui/My/Config/Install.txt. The manipulation leads to direct request. The attack can…

  10. 8.8CVE-2022-42438EPSS 0.5%

    IBM Cloud Pak for Multicloud Management Monitoring 2.0 and 2.3 allows users without admin roles access to admin functions by specifying direct URL paths. IBM X-Force ID: 238210.

  11. 7.5CVE-2022-47700EPSS 0.5%

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid …

  12. 5.3CVE-2022-4057ExploitEPSS 1.5%

    The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.

  13. 7.5CVE-2022-42953ExploitEPSS 5.2%

    Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-51…

  14. 5.3CVE-2022-25626EPSS 0.7%

    An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session.

  15. 9.8CVE-2022-45276EPSS 0.9%

    An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password.

  16. 6.5CVE-2022-40845EPSS 0.7%

    The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper session management vulnerability, an attacker with access to the router may be …

  17. 6.5CVE-2022-42197EPSS 0.7%

    In Simple Exam Reviewer Management System v1.0 the User List function has improper access control that allows low privileged users to modify user permissions to higher privileges.

  18. 8.8CVE-2022-42238EPSS 1.0%

    A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.

  19. 9.1CVE-2022-41746EPSS 1.2%

    A forced browsing vulnerability in Trend Micro Apex One could allow an attacker with access to the Apex One console on affected installations to escalate privileges and modify certain agent groupings. Please note: an attacker must first ob…

  20. 8.0CVE-2022-36158EPSS 1.6%

    Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

  21. 7.5CVE-2022-2551ExploitEPSS 18%

    The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing downloa…

  22. 7.5CVE-2022-2544ExploitEPSS 4.6%

    The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.

  23. 5.7CVE-2022-34574EPSS 0.6%

    An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini.

  24. 6.3CVE-2022-34573EPSS 0.6%

    An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml.

  25. 5.7CVE-2022-34572EPSS 0.6%

    An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.

  26. 8.0CVE-2022-34571EPSS 0.9%

    An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.

  27. 7.5CVE-2022-34570EPSS 1.0%

    WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.

  28. 6.5CVE-2022-1551EPSS 1.0%

    The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.

  29. 8.8CVE-2022-2192EPSS 1.1%

    Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions late…

  30. 4.3CVE-2022-29238EPSS 1.2%

    Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidde…

  31. 7.5CVE-2022-31847ExploitEPSS 6.6%

    A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.

  32. 6.5CVE-2021-40616EPSS 0.8%

    thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user manageme…

  33. 8.8CVE-2021-44582EPSS 1.5%

    A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL.

  34. 5.3CVE-2022-31485EPSS 0.8%

    An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, …

  35. 7.5CVE-2022-31484EPSS 1.1%

    An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 wh…

  36. 7.5CVE-2022-31480EPSS 1.0%

    An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a Denial-of-Service (DoS). This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500…

  37. 8.8CVE-2022-28799EPSS 16%

    The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force the com.zhiliaoapp.musically WebView to load an arbitrary website. This may allow an attacker to leverage an attached …

  38. 7.5CVE-2022-28991EPSS 1.5%

    Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files.

  39. 8.6CVE-2021-34588EPSS 0.9%

    In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot .

  40. 5.3CVE-2022-26777EPSS 2.1%

    Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.

  41. 5.3CVE-2022-26653EPSS 2.1%

    Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator).

  42. 7.5CVE-2022-27480EPSS 2.5%

    A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenti…

  43. 5.3CVE-2022-28365ExploitEPSS 9.3%

    Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network …

  44. 7.5CVE-2022-1077EPSS 2.5%

    A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The att…

  45. 9.8CVE-2022-26279EPSS 1.8%

    EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.

  46. 6.5CVE-2022-24385EPSS 0.9%

    A Direct Object Access vulnerability in SmarterTools SmarterTrack leads to information disclosure This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.

  47. 7.5CVE-2021-46378ExploitEPSS 32%

    DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download.

  48. 5.3CVE-2022-26159ExploitEPSS 13%

    The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain …

  49. 6.5CVE-2022-23607EPSS 1.1%

    treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HTTPClient` constructor accept cookies as a dictionary. Such cookies are not bound…

  50. 5.3CVE-2021-24046EPSS 0.7%

    A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device software before 2107460.6810.0.