1025
CAPEC-ID Attack Pattern Name
127 Directory Indexing
554 Functionality Bypass
CWE-425: Direct Request ('Forced Browsing')
Weakness ID : 425
Structure : Simple
Abstraction : Base
Description
The web application does not adequately enforce appropriate authorization on all restricted URLs,
scripts, or files.
Extended Description
Web applications susceptible to direct request attacks often make the false assumption that such
resources can only be reached through a given navigation path and so only apply authorization at
certain points in the path.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 288 Authentication Bypass Using an Alternate Path or Channel 700
ChildOf 424 Improper Protection of Alternate Path 1023
ChildOf 862 Missing Authorization 1780
CanPrecede 98 Improper Control of Filename for Include/Require Statement
in PHP Program ('PHP Remote File Inclusion')