cve.bz

CWE-425: Direct Request (Forced Browsing), page 5

Filter

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

What the weakness is: CWE-425 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 5
  • CAPEC-87 Forceful Browsing Likelihood: High · Severity: High
  • CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
  • CAPEC-143 Detect Unpublicized Web Pages Severity: Low
  • CAPEC-144 Detect Unpublicized Web Services Severity: Low
  • CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB) Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-425, as MITRE names them. Credits.

Ask an AI about CWE-425

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-425: Direct Request and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/425.html and https://cve.bz/cve/cwe/425?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2019-13981EPSS 1.5%

    In Directus 7 API through 2.3.0, remote attackers can read image files via a direct request for a filename under the uploads/_/originals/ directory. This is related to a configuration option in which the file collection can be non-public, …

  2. 9.1CVE-2019-12583ExploitEPSS 44%

    Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access…

  3. 5.3CVE-2019-1899EPSS 3.4%

    A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper a…

  4. 5.3CVE-2019-1898ExploitEPSS 42%

    A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authori…

  5. 5.3CVE-2019-3934EPSS 7.7%

    Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to downloa…

  6. 5.3CVE-2019-3933EPSS 5.9%

    Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to w…

  7. 7.5CVE-2019-3916EPSS 2.1%

    Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated attacker to retrieve the value of the password salt by simply requesting an API URL in a web browse…

  8. 8.8CVE-2018-18862EPSS 2.9%

    BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+Sys…

  9. 7.5CVE-2019-3917EPSS 2.4%

    The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on the router via a crafted HTTP request.

  10. 9.8CVE-2019-9552EPSS 2.0%

    Eloan V3.0 through 2018-09-20 allows remote attackers to list files via a direct request to the p2p/api/ or p2p/lib/ or p2p/images/ URI.

  11. 7.5CVE-2019-6551EPSS 3.3%

    Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafted URL to cause the device to reboot, which may be used to cause a continual denial-of-service condi…

  12. 9.8CVE-2019-7736EPSS 2.7%

    D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.

  13. 7.5CVE-2019-6126EPSS 1.4%

    The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of inf…

  14. 8.0CVE-2018-6669EPSS 0.5%

    A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.

  15. 9.8CVE-2018-18922EPSS 2.4%

    add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.

  16. 4.3CVE-2018-19620EPSS 1.3%

    ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.

  17. 9.8CVE-2018-19207ExploitEPSS 88%

    The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

  18. 6.5CVE-2018-19143EPSS 0.9%

    Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.

  19. 8.8CVE-2018-19109EPSS 1.8%

    tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.

  20. 7.5CVE-2018-16706EPSS 22%

    LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.

  21. 10.0CVE-2018-3774EPSS 3.8%

    Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

  22. 7.5CVE-2018-7526EPSS 1.3%

    In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the applicatio…

  23. 4.3CVE-2018-11346EPSS 1.2%

    An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act par…

  24. 6.5CVE-2018-0267EPSS 0.4%

    A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted. This could include LDAP credentials. The vulnerability is due to in…

  25. 4.3CVE-2018-0266EPSS 1.7%

    A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables over the web interfac…

  26. 5.3CVE-2018-0198EPSS 1.7%

    A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could …

  27. 9.8CVE-2017-17736ExploitEPSS 68%

    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.

  28. 7.5CVE-2017-14993EPSS 1.2%

    OXID eShop Community Edition before 6.0.0 RC3 (development), 4.10.x before 4.10.6 (maintenance), and 4.9.x before 4.9.11 (legacy), Enterprise Edition before 6.0.0 RC3 (development), 5.2.x before 5.2.11 (legacy), and 5.3.x before 5.3.6 (mai…

  29. 6.5CVE-2018-0140EPSS 1.6%

    A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote attacker to download any message from the spam quarantine by modifying browser st…

  30. 9.8CVE-2018-6624EPSS 1.6%

    OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.

  31. 5.3CVE-2018-0105EPSS 1.7%

    A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could …

  32. 7.5CVE-2017-15235ExploitEPSS 5.5%

    The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads via a crafted fn parameter that corresponds to the exact filename.

  33. 9.8CVE-2017-14244ExploitEPSS 17%

    An authentication bypass vulnerability on iBall Baton ADSL2+ Home Router FW_iB-LR7011A_1.0.2 devices potentially allows attackers to directly access administrative router settings by crafting URLs with a .cgi extension, as demonstrated by …

  34. 9.1CVE-2017-10833EPSS 1.5%

    "Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to bypass access restriction to view information or modify configurations via unspecified vectors.

  35. 3.5CVE-2017-2161EPSS 0.4%

    FlashAirTM SDHC Memory Card (SD-WE Series <W-03>) V3.00.02 and earlier and FlashAirTM SDHC Memory Card (SD-WD/WC Series <W-02>) V2.00.04 and earlier allows authenticated attackers to bypass access restrictions to obtain unauthorized image …

  36. 5.3CVE-2017-2143EPSS 1.2%

    CS-Cart Japanese Edition v4.3.10-jp-1 and earlier, CS-Cart Multivendor Japanese Edition v4.3.10-jp-1 and earlier allows remote attackers to bypass access restriction to create a request to return a customer purchased item via rma.post.php.

  37. 5.3CVE-2017-2139EPSS 1.2%

    CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3), CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to bypass access restriction to obtain customer information via orde…

  38. 6.5CVE-2017-2486EPSS 1.6%

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the address bar via a crafted web site.

  39. –CVE-2015-2873EPSS 2.7%

    Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensiti…

  40. –CVE-2005-1892EPSS 2.2%

    FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which triggers an infinite loop, or (2) direct requests to unknown scripts, which reveals the we…

  41. –CVE-2005-1827ExploitEPSS 20%

    D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or restore a saved configuration, via a direct request to firmwarecfg.

  42. –CVE-2005-1698EPSS 1.1%

    PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8…

  43. –CVE-2005-1697EPSS 1.1%

    The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to simple_smarty.php, which reveals the path in an error message.

  44. 5.3CVE-2005-1688EPSS 2.0%

    Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/, which reveal the path in an error message.

  45. –CVE-2005-1685EPSS 1.7%

    episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp.

  46. –CVE-2005-1668EPSS 2.0%

    YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp.

  47. –CVE-2005-1654ExploitEPSS 2.5%

    Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.

  48. 5.3CVE-2004-2257EPSS 2.3%

    phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request.

  49. –CVE-2004-2144EPSS 2.8%

    Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php.

  50. 9.1CVE-2002-1798ExploitEPSS 4.6%

    MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or (2) access sensitive information via a direct request to admin/credit_card_info.php.