cve.bz

CWE-602: Client-Side Enforcement of Server-Side Security, page 4

Filter

The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.

What the weakness is: CWE-602 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 12
  • CAPEC-21 Exploitation of Trusted Identifiers Likelihood: High · Severity: High
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-162 Manipulating Hidden Fields Severity: High
  • CAPEC-202 Create Malicious Client Severity: Medium
  • CAPEC-207 Removing Important Client Functionality Likelihood: Medium · Severity: High
  • CAPEC-208 Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-602, as MITRE names them. Credits.

Ask an AI about CWE-602

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-602: Client-Side Enforcement of Server-Side Security and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/602.html and https://cve.bz/cve/cwe/602?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2023-48789EPSS 0.5%

    A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access control via crafted HTTP requests.

  2. 5.3CVE-2024-32685EPSS 0.4%

    Client-Side Enforcement of Server-Side Security vulnerability in Wpmet Wp Ultimate Review allows Functionality Bypass.This issue affects Wp Ultimate Review: from n/a through 2.2.5.

  3. 5.3CVE-2024-32521EPSS 0.4%

    Client-Side Enforcement of Server-Side Security vulnerability in Highfivery LLC Zero Spam allows Removing Important Client Functionality.This issue affects Zero Spam: from n/a through 5.5.6.

  4. 5.3CVE-2024-32512EPSS 0.3%

    Client-Side Enforcement of Server-Side Security vulnerability in weForms allows Removing Important Client Functionality.This issue affects weForms: from n/a through 1.6.20.

  5. 8.8CVE-2024-31491EPSS 0.8%

    A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests.

  6. 8.8CVE-2024-28029EPSS 0.7%

    Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.

  7. 5.3CVE-2024-0701EPSS 0.6%

    The UserPro plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 5.1.6. This is due to the use of client-side restrictions to enforce the 'Disabled registration' Membership feature within the …

  8. 8.1CVE-2023-23570EPSS 0.7%

    Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all…

  9. 6.5CVE-2023-42787EPSS 1.7%

    A client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a …

  10. 5.5CVE-2023-3747EPSS 0.2%

    Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators to allow a device to temporarily be disconnected from WARP, however, due to lac…

  11. 4.9CVE-2023-39218EPSS 1.1%

    Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.

  12. 5.4CVE-2023-30955EPSS 0.4%

    A security defect was identified in Foundry workspace-server that enabled a user to bypass an authorization check and view settings related to 'Developer Mode'. This enabled users with insufficient privilege the ability to view and interac…

  13. 4.9CVE-2023-20172EPSS 0.4%

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid cred…

  14. 6.5CVE-2023-20171EPSS 0.4%

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid cred…

  15. 3.8CVE-2023-20106EPSS 0.4%

    Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid cred…

  16. 9.8CVE-2023-0750EPSS 0.4%

    Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface.  When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the pa…

  17. 6.5CVE-2023-0704EPSS 1.0%

    Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)

  18. 5.3CVE-2023-0581EPSS 0.7%

    The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via clien…

  19. 6.5CVE-2022-3310EPSS 0.6%

    Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. (Chromium securi…

  20. 7.4CVE-2022-3308EPSS 0.8%

    Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

  21. 6.5CVE-2022-3047EPSS 0.6%

    Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted HTML page.

  22. 9.1CVE-2022-1525EPSS 0.9%

    The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modif…

  23. 8.0CVE-2022-31233EPSS 0.3%

    Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have ac…

  24. 8.0CVE-2021-36338EPSS 0.4%

    Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not hav…

  25. 9.6CVE-2022-20658EPSS 1.4%

    A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate …

  26. 2.7CVE-2021-21544EPSS 0.9%

    Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under t…

  27. 7.8CVE-2021-21531EPSS 0.7%

    Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions.

  28. 6.5CVE-2020-27268EPSS 0.5%

    In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for de…

  29. 9.8CVE-2020-24683EPSS 1.5%

    The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a…

  30. 5.4CVE-2020-5345EPSS 0.7%

    Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an authorization bypass vulnerability. An authenticated maliciou…

  31. 7.5CVE-2020-8162EPSS 3.0%

    A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload …

  32. 8.8CVE-2017-12161EPSS 1.3%

    It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid re…

  33. 5.6CVE-2017-14013EPSS 0.9%

    A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an atta…

  34. –CVE-2014-2374EPSS 1.9%

    The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.

  35. –CVE-2014-2373EPSS 1.8%

    The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings via vectors involving JavaScript.