CWE-602 Client-Side Enforcement of Server-Side Security
classThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
03
Schwachstellen (188)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-23666US | high8.8 | Exploit | ||
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData
at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7… | ||||
| CVE-2020-8162US | high7.5 | Exploit | ||
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct… | ||||
| CVE-2020-24683US | critical9.8 | — | ||
The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authenticat… | ||||
| CVE-2017-8864US | critical9.8 | — | ||
Client-side enforcement using JavaScript of server-side security options on the Cohu 3960HD allows an attacker to manipulate options sent to the camera and cause malfunction or cod… | ||||
| CVE-2026-30783US | critical9.8 | — | ||
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) al… | ||||
| CVE-2026-23478US | critical9.8 | — | ||
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated… | ||||
| CVE-2025-28168US | critical9.8 | — | ||
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solel… | ||||
| CVE-2023-0750US | critical9.8OT erhöht | — | ||
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authenticat… | ||||
| CVE-2026-14109US | critical9.6 | — | ||
Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… | ||||
| CVE-2022-20658US | critical9.6 | — | ||
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM… | ||||
| CVE-2026-25737US | critical9.0 | — | ||
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file exte… | ||||
| CVE-2022-1525US | critical9.1 | — | ||
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow atta… | ||||
| CVE-2025-33137US | high8.8 | — | ||
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-sid… | ||||
| CVE-2025-32359US | high8.8 | — | ||
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate w… | ||||
| CVE-2024-52960US | high8.8 | — | ||
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attac… | ||||
| CVE-2024-9844US | high8.8 | — | ||
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions. | ||||
| CVE-2024-52008US | high8.8 | — | ||
Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak… | ||||
| CVE-2024-31491US | high8.8 | — | ||
A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthoriz… | ||||
| CVE-2024-28029US | high8.8 | — | ||
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality. | ||||
| CVE-2017-12161US | high8.8 | — | ||
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to c… | ||||
04
Angriffsmuster (12)
CAPEC-Angriffsmuster, die dies ausnutzen.
05
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan