Overview

The Insecure Access Control category contains several vulnerability classes:

• Improper Access Control (CWE-284)
• Insecure Direct Object Reference (IDOR) (CWE-639)
• Open Redirect (CWE-601)
• Cross-Site Request Forgery (CSRF) (CWE-352)
• Cross-Site WebSocket Hijacking(CSWSH) (CWE-1385)
• Sensitive Data in URLs (CWE-598)