help naming a vulnerability

URL: https://www.bedrock.com/accounts/aspx?user=fredflintstone

Essentially, I'm logged in as fredflintstone and can view his account info. Suppose I know the name of another user and modify the URL: https://www.bedrock.com/accounts/aspx?user=joerockhead

Now I can see joerockhead's account info. Moreover, I can modify joerockhead's info and even delete it.

What would you call that vulnerability?

Edit: I know this is bad form. Just trying to learn.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

iBrokeIT

For web vulnerabilities start with the OWASP Top 10.

"A2:2017-Broken Authentication: Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. "

https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

tedjames

Fantastic, thank you!

LonerVamp

I would actually call this a Broken Access control issue.

tedjames

LonerVamp said:

I would actually call this a Broken Access control issue.

After reading the descriptions of both on OWASP, I believe that Broken Access is the correct name for this type of vulnerability. Thanks!