1265
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 696 Incorrect Behavior Order 1527
ChildOf 863 Incorrect Authorization 1787
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1212 Authorization Errors 2476
MemberOf 438 Behavioral Problems 2326
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal
representation before being validated and processed for authorization. Make sure that your
application does not decode the same input twice. Such errors could be used to bypass allowlist
schemes by introducing dangerous inputs after they have been checked.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 949 SFP Secondary Cluster: Faulty Endpoint Authentication 888 2395
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
CWE-552: Files or Directories Accessible to External Parties
Weakness ID : 552
Structure : Simple
Abstraction : Base
Description
The product makes files or directories accessible to unauthorized actors, even though they should
not be.
Extended Description
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory
that is accessible to the server's users. Applications may store sensitive files underneath this root
without also using access control to limit which users may request those files, if any. Alternately, an
CWE Version 4.14
CWE-552: Files or Directories Accessible to External Parties
CWE-552: Files or Directories Accessible to External Parties