OWASP Top Ten 2021 Category A01:2021 - Broken Access Control

Opis

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.

Wpisy w tej grupie

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-23 Relative Path Traversal
• CWE-35 Path Traversal: '.../...//'
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-201 Insertion of Sensitive Information Into Sent Data
• CWE-219 Storage of File with Sensitive Data Under Web Root
• CWE-264 Permissions, Privileges, and Access Controls
• CWE-275 Permission Issues
• CWE-276 Incorrect Default Permissions
• CWE-284 Improper Access Control
• CWE-285 Improper Authorization
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
• CWE-377 Insecure Temporary File
• CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
• CWE-425 Direct Request ('Forced Browsing')
• CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
• CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
• CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
• CWE-540 Inclusion of Sensitive Information in Source Code
• CWE-548 Exposure of Information Through Directory Listing
• CWE-552 Files or Directories Accessible to External Parties
• CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-651 Exposure of WSDL File Containing Sensitive Information
• CWE-668 Exposure of Resource to Wrong Sphere
• CWE-706 Use of Incorrectly-Resolved Name or Reference
• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization
• CWE-913 Improper Control of Dynamically-Managed Code Resources
• CWE-922 Insecure Storage of Sensitive Information
• CWE-1275 Sensitive Cookie with Improper SameSite Attribute

Uwagi

As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła