1350
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 801 2010 Top 25 - Insecure Interaction Between
Components
800 2354
MemberOf 819 OWASP Top Ten 2010 Category A10 - Unvalidated
Redirects and Forwards
809 2360
MemberOf 864 2011 Top 25 - Insecure Interaction Between
Components
900 2371
MemberOf 884 CWE Cross-section 884 2567
MemberOf 938 OWASP Top Ten 2013 Category A10 - Unvalidated
Redirects and Forwards
928 2393
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1345 OWASP Top Ten 2021 Category A01:2021 - Broken
Access Control
1344 2487
MemberOf 1382 ICS Operations (& Maintenance): Emerging Energy
Technologies
1358 2517
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 38 URl Redirector Abuse
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
178 Cross-Site Flashing
References
[REF-483]Craig A. Shue, Andrew J. Kalafut and Minaxi Gupta. "Exploitable Redirects on the Web:
Identification, Prevalence, and Defense". < https://www.cprogramming.com/tutorial/exceptions.html
>.2023-04-07.
[REF-484]Russ McRee. "Open redirect vulnerabilities: definition and prevention". Issue 17.
(IN)SECURE. 2008 July. < http://www.net-security.org/dl/insecure/INSECURE-Mag-17.pdf >.
[REF-485]Jason Lam. "Top 25 Series - Rank 23 - Open Redirect". 2010 March 5. SANS Software
Security Institute. < http://software-security.sans.org/blog/2010/03/25/top-25-series-rank-23-openredirect
>.
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
CWE-602: Client-Side Enforcement of Server-Side Security
Weakness ID : 602
Structure : Simple
Abstraction : Class
Description
The product is composed of a server that relies on the client to implement a mechanism that is
intended to protect the server.
Extended Description
CWE Version 4.14
CWE-602: Client-Side Enforcement of Server-Side Security
CWE-602: Client-Side Enforcement of Server-Side Security