Improper Protection of Alternate Path

Opis

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Skutki

• Access Control

  Bypass Protection Mechanism; Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design

  Deploy different layers of protection to implement security in depth.

Przykłady podatności

• CVE-2022-29238 Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.

Słabość nadrzędna

• CWE-693 Protection Mechanism Failure
• CWE-638 Not Using Complete Mediation

Słabości podrzędne

• CWE-425 Direct Request ('Forced Browsing')

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based