1026
forced browsing : The "forced browsing" term could be misinterpreted to include weaknesses
such as CSRF or XSS, so its use is discouraged.
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Access Control
Read Application Data
Modify Application Data
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity
Potential Mitigations
Phase: Architecture and Design
Phase: Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or
files.
Phase: Architecture and Design
Consider using MVC based frameworks such as Struts.
Demonstrative Examples
Example 1:
If forced browsing is possible, an attacker may be able to directly access a sensitive page by
entering a URL similar to the following.
Example Language: JSP (Attack)
http://somesite.com/someapplication/admin.jsp
Observed Examples
Reference Description
CVE-2022-29238 Access-control setting in web-based document collaboration tool is not
properly implemented by the code, which prevents listing hidden directories but
does not prevent direct requests to files in those directories.
https://www.cve.org/CVERecord?id=CVE-2022-29238
CVE-2022-23607 Python-based HTTP library did not scope cookies to a particular domain such
that "supercookies" could be sent to any domain on redirect.
https://www.cve.org/CVERecord?id=CVE-2022-23607
CVE-2004-2144 Bypass authentication via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-2144
CVE-2005-1892 Infinite loop or infoleak triggered by direct requests.
https://www.cve.org/CVERecord?id=CVE-2005-1892
CVE-2004-2257 Bypass auth/auth via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-2257
CVE-2005-1688 Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1688
CVE-2005-1697 Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1697
CVE-2005-1698 Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1698
CVE-2005-1685 Authentication bypass via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1685
CVE-2005-1827 Authentication bypass via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1827
CVE-2005-1654 Authorization bypass using direct request.
CWE Version 4.14
CWE-425: Direct Request ('Forced Browsing')
CWE-425: Direct Request ('Forced Browsing')