The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
View on MITREWeb applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Consider using MVC based frameworks such as Struts.
No detection method information available for this CWE.
If forced browsing is possible, an attacker may be able to directly access a sensitive page by entering a URL similar to the following.
Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
View DetailsPython-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect.
View DetailsCWE-425: Direct Request ('Forced Browsing') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
If exploited, CWE-425 (Direct Request ('Forced Browsing')) it can compromise Confidentiality, Integrity, Availability and Access Control, leading to outcomes such as Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands and Gain Privileges or Assume Identity.
Recommended mitigations for CWE-425 include: Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files. Consider using MVC based frameworks such as Struts.
CWE-425 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-425, including CVE-2022-29238, CVE-2022-23607, CVE-2004-2144, CVE-2005-1892 and CVE-2004-2257. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-425 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.