cve.bz

CWE-425: Direct Request (Forced Browsing), page 4

Filter

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

What the weakness is: CWE-425 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-87 Forceful Browsing Likelihood: High · Severity: High
  • CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
  • CAPEC-143 Detect Unpublicized Web Pages Severity: Low
  • CAPEC-144 Detect Unpublicized Web Services Severity: Low
  • CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB) Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-425, as MITRE names them. Credits.

Ask an AI about CWE-425

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-425: Direct Request and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/425.html and https://cve.bz/cve/cwe/425?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2021-42748EPSS 1.0%

    In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.

  2. 7.5CVE-2021-24831EPSS 1.2%

    All AJAX actions of the Tab WordPress plugin before 1.3.2 are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs.

  3. 7.5CVE-2021-24695EPSS 1.7%

    The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensit…

  4. 7.5CVE-2021-42671EPSS 20%

    An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploads. An attacker can leverage this vulnerability in order to bypass access controls and access all t…

  5. 9.8CVE-2021-36560EPSS 1.5%

    Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin.

  6. 7.5CVE-2018-16060ExploitEPSS 20%

    Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI.

  7. 9.8CVE-2021-36745EPSS 9.4%

    A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft Windows / Novell Netware 5.8 could allow a remote attacker to …

  8. 7.5CVE-2021-40875ExploitEPSS 47%

    Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of appli…

  9. 5.3CVE-2021-26085KEVExploitEPSS >99.9%

    Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from v…

  10. 7.5CVE-2021-20114ExploitEPSS 6.0%

    When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which included sensitive database backup files.

  11. 5.5CVE-2021-28150ExploitEPSS 2.8%

    Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) via /backup2.cgi.

  12. 6.5CVE-2021-24238EPSS 1.1%

    The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tamperi…

  13. 9.8CVE-2021-24215ExploitEPSS 8.7%

    An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php …

  14. 4.3CVE-2021-30144EPSS 0.8%

    The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the last ten events, the connected users, and the users in the tech category. For example, plugins/dashboa…

  15. 4.3CVE-2021-22180EPSS 0.8%

    An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

  16. 5.3CVE-2020-35570EPSS 1.2%

    An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing.

  17. 7.5CVE-2021-3113EPSS 3.2%

    Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens t…

  18. 8.1CVE-2019-20484EPSS 0.9%

    An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in.

  19. 6.5CVE-2020-35391ExploitEPSS 35%

    Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vuln…

  20. 7.5CVE-2019-25012EPSS 1.5%

    The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy.

  21. 9.8CVE-2019-12768EPSS 2.3%

    An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass authentication via forceful browsing.

  22. 6.5CVE-2020-13474EPSS 0.8%

    In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.

  23. 5.3CVE-2020-7541EPSS 0.9%

    A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions),…

  24. 7.5CVE-2020-29656EPSS 1.1%

    An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. A direct access to /downloadmaster/dm_apply.cgi?action_mode=initial&download_type=General&special_cgi=get_language makes it possible to reach "unk…

  25. 7.5CVE-2020-28937EPSS 1.3%

    OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's medical test results, possibly resulting in disclosure of Protected Health Information (PHI) stored in…

  26. 7.5CVE-2020-24765EPSS 6.8%

    InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitoring/rs/api/system/dump-diagnostic-info?server=127.0.0.1 request.

  27. 7.5CVE-2020-26150EPSS 1.3%

    info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.

  28. 9.8CVE-2020-24660EPSS 2.5%

    An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemo…

  29. 9.8CVE-2020-24203EPSS 3.7%

    Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.

  30. 7.5CVE-2020-13850EPSS 2.2%

    Artica Pandora FMS 7.44 has inadequate access controls on a web folder.

  31. 5.3CVE-2019-2388EPSS 1.0%

    In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access log of a publicly exposed Ops Manager instance. This issue affects: MongoDB Inc. MongoDB Ops Manager 4.0 versions 4.0.9,…

  32. 8.8CVE-2020-11561EPSS 2.2%

    In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.

  33. 5.3CVE-2016-1000111EPSS 2.8%

    Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might al…

  34. 7.5CVE-2020-10248EPSS 1.4%

    BWA DiREX-Pro 1.2181 devices allow remote attackers to discover passwords via a direct request to val_users.php3.

  35. 6.5CVE-2020-8439EPSS 1.6%

    Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.

  36. 7.5CVE-2019-17646EPSS 1.7%

    An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.

  37. 7.5CVE-2019-17645EPSS 1.5%

    An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php.

  38. 7.5CVE-2019-17644EPSS 1.1%

    An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php.

  39. 7.5CVE-2019-17643EPSS 1.4%

    An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php.

  40. 4.3CVE-2019-16388EPSS 0.7%

    PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account. NOTE: The vendor states that this vulnera…

  41. 4.3CVE-2019-16386EPSS 0.8%

    PEGA Platform 7.x and 8.x is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyActivity=GetWebInfo&target=popup&pzHarnessID=random_harness_id request to get database schema information while using a low-p…

  42. 9.8CVE-2019-16340EPSS 19%

    Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.

  43. 7.5CVE-2019-14927ExploitEPSS 41%

    An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's config…

  44. 5.3CVE-2019-17503ExploitEPSS 48%

    An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL …

  45. 8.8CVE-2019-11326EPSS 1.2%

    An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product is protected by a login. A guest is allowed to login. Once logged in as a guest, an attacker can browse a URL …

  46. 4.3CVE-2019-1220EPSS 3.8%

    A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'.

  47. 9.8CVE-2019-9584EPSS 2.7%

    eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting down the VPN service and to delete the VPN service configuration. This is related to impr…

  48. 8.2CVE-2019-13030EPSS 1.9%

    eQ-3 Homematic CCU3 AddOn 'Mediola NEO Server for Homematic CCU3' prior to 2.4.5 allows uncontrolled admin access to start or stop the Node.js process, resulting in the ability to obtain mediola configuration details. This is related to im…

  49. 8.8CVE-2019-14347ExploitEPSS 9.3%

    Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.

  50. 9.8CVE-2019-9884EPSS 3.0%

    eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.