The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
View on MITREDeploy different layers of protection to implement security in depth.
No detection method information available for this CWE.
Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
View DetailsNo relationship information available for this CWE.
CWE-424: Improper Protection of Alternate Path is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
If exploited, CWE-424 (Improper Protection of Alternate Path) it can compromise Access Control, leading to outcomes such as Bypass Protection Mechanism and Gain Privileges or Assume Identity.
Recommended mitigations for CWE-424 include: Deploy different layers of protection to implement security in depth.
CWE-424 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-424, including CVE-2022-29238. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-424 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.