Client-Side Enforcement of Server-Side Security
CWE-602
The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
We track 70 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: If some degree of trust is required between the two entities, then use integrity checking and strong authentication to ensure that the inputs are coming from a trusted source. Design the product so that this trust is managed in a centralized fashion, especially if there are complex or numerous communication channels, in order to reduce the risks that the implementer will mistakenly omit a check in a single code path.
Latest Client-Side Enforcement of Server-Side Security vulnerabilities
- 9.8 Critical severity
WorkExaminer Professional: Client-Side Enforcement of Server-Side Security
An unauthenticated attacker with access to TCP port 12306 of the WorkExaminer server can exploit missing server-side authentication checks to bypass the login prompt in the WorkExaminer Professional console to gain administrative access to the WorkExaminer ser
- 8.7 High severity
Vitogate 300: Client-Side Enforcement of Server-Side Security
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By rem
- 8.8 High severity
In-Sight 2000 series: Client-Side Enforcement of Server-Side Security
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network setting
- 7.5 High severity
Order Tip for WooCommerce: Client-Side Enforcement of Server-Side Security
The Order Tip for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Improper Input Validation in all versions up to, and including, 1.5.4. This is due to lack of server-side validation on the `data-tip` attribute, which makes it possible for un
- 7.5 High severity
FOIAXpress Public Access Link (PAL): Improper Restriction of Excessive Authentication Attempts
OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.
- 7.7 High severity
RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi
- 7.5 High severity
wivia 5: Client-Side Enforcement of Server-Side Security
Client-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass authentication and operate the affected device as the moderator user.
- 8.8 High severity
Aspera Faspex: Client-Side Enforcement of Server-Side Security
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
- 7.1 High severity
Cisco Unified Contact Center Express: Client-Side Enforcement of Server-Side Security
A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due to insufficient server-side validation of
- 9.9 Critical severity
RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi
- 9.9 Critical severity
RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi
- 9.9 Critical severity
RUGGEDCOM ROX MX5000: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (All versions < V2.16.5), RUGGEDCOM ROX RX1500 (All versions < V2.16.5), RUGGEDCOM ROX RX1501 (All versi
- 9.8 Critical severity
Multiple File Upload: Unrestricted Upload of File with Dangerous Type
The Multiple File Upload add-on component 3.1.0 for OutSystems is vulnerable to Unrestricted File Upload. This occurs because file extension and size validations are enforced solely on the client side. An attacker can intercept the upload request and modify a
- 8.2 High severity
KYC solutions: Client-Side Enforcement of Server-Side Security
This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API endpoints. A remote attacker could exploit this vulnerability by intercepting the request and removing the Captcha parameter leading to byp
- 7.7 High severity
InQuizitive: Client-Side Enforcement of Server-Side Security
W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.
- 8.8 High severity
Zammad: Client-Side Enforcement of Server-Side Security
In Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configuration, users need to re-authenticate with their current password first. However, this change was enforced in Zammad on
- 8.8 High severity
FortiSandbox: Client-Side Enforcement of Server-Side Security
A client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and before 4.2.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via craf
- 8.8 High severity
Connect Secure: Client-Side Enforcement of Server-Side Security
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker to bypass restrictions.
- 8.8 High severity
fides: Client-Side Enforcement of Server-Side Security
Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password co
- 8.8 High severity
FortiManager: Client-Side Enforcement of Server-Side Security
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7
- 7.8 High severity
Workspace Control: Client-Side Enforcement of Server-Side Security
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
- 7.8 High severity
SINEMA Remote Connect Server: Client-Side Enforcement of Server-Side Security
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of
- 8.8 High severity
FortiSandbox: Client-Side Enforcement of Server-Side Security
A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests.
- 8.8 High severity
DIAEnergie: Client-Side Enforcement of Server-Side Security
Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.
- 8.1 High severity
Command Centre: Client-Side Enforcement of Server-Side Security
Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undefined behavior. This issue affects: Gallagher Command Centre 8.90 prior to vEL8.90.1620 (MR2), all versions of 8.80 and p
- 9.8 Critical severity
Yellowbrik: Missing Encryption of Sensitive Data
Yellobrik PEC-1864 implements authentication checks via javascript in the frontend interface. When the device can be accessed over the network an attacker could bypass authentication. This would allow an attacker to : - Change the password, resulting in a DOS
- 7.4 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- 9.1 Critical severity
3D-A1000 Dimensioning System: Client-Side Enforcement of Server-Side Security
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code
- 8.0 High severity
Unisphere for PowerMax: Incorrect Resource Transfer Between Spheres
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to.
- 9.6 Critical severity
Cisco Unified Contact Center Domain Manager: Incorrect Resource Transfer Between Spheres
A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote attacker to elevate their privileges to A