OWASP Top Ten 2025 Category A01:2025 - Broken Access Control

Opis

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-1275 Sensitive Cookie with Improper SameSite Attribute
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-201 Insertion of Sensitive Information Into Sent Data
• CWE-219 Storage of File with Sensitive Data Under Web Root
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-23 Relative Path Traversal
• CWE-276 Incorrect Default Permissions
• CWE-281 Improper Preservation of Permissions
• CWE-282 Improper Ownership Management
• CWE-283 Unverified Ownership
• CWE-284 Improper Access Control
• CWE-285 Improper Authorization
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
• CWE-36 Absolute Path Traversal
• CWE-377 Insecure Temporary File
• CWE-379 Creation of Temporary File in Directory with Insecure Permissions
• CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')
• CWE-424 Improper Protection of Alternate Path
• CWE-425 Direct Request ('Forced Browsing')
• CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
• CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
• CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
• CWE-540 Inclusion of Sensitive Information in Source Code
• CWE-548 Exposure of Information Through Directory Listing
• CWE-552 Files or Directories Accessible to External Parties
• CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• CWE-61 UNIX Symbolic Link (Symlink) Following
• CWE-615 Inclusion of Sensitive Information in Source Code Comments
• CWE-639 Authorization Bypass Through User-Controlled Key
• CWE-65 Windows Hard Link
• CWE-668 Exposure of Resource to Wrong Sphere
• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-749 Exposed Dangerous Method or Function
• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization
• CWE-918 Server-Side Request Forgery (SSRF)
• CWE-922 Insecure Storage of Sensitive Information

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła