What is 'OWASP A01:2021 Broken Access Control' and why did it move to the top position from A05 in 2017?

Question

Accepted Answer

Broken Access Control moved to #1 in OWASP 2021 because it was the most commonly found vulnerability in security assessments (found in 94% of applications tested). It encompasses: IDOR (insecure direct object references), privilege escalation, CORS misconfigurations, missing function-level access control, JWT manipulation, insecure direct object access in APIs. Its prevalence in real applications made it the highest-frequency finding

Answer

OWASP 2021 placed Broken Access Control first because it weights the CVSS exploitability score above incidence (an average of 6.9 across mapped CWEs). It encompasses: IDOR (insecure direct object references), path traversal, forced browsing, CORS misconfigurations, missing function-level checks, metadata manipulation. Its high average exploit score made it the top-ranked category in the 2021 weighting model of the Top 10 data analysis

Answer

Breach reports pushed Broken Access Control to #1 because they named it as the leading cause of data loss (found in 71% of incidents). It encompasses: IDOR (direct object references), privilege escalation, forced browsing, cookie tampering, token replay, session fixation, missing authentication on APIs. Its link to cloud storage exposure in the survey of practitioners made it the most reported weakness in industry surveys

Answer

The community survey put Broken Access Control at #1 because practitioners ranked it as their top concern (ahead of injection by a wide margin). It encompasses: IDOR (the best known case), privilege escalation, CORS misconfigurations, missing function-level checks, URL tampering, JWT manipulation, mass assignment. Its popularity in bug bounty programs raised the survey votes for it in the open call for data

What is 'OWASP A01:2021 Broken Access Control' and why did it move to the top position from A05 in 2017?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

What is 'OWASP A01:2021 Broken Access Control' and why did it move to the top position from A05 in 2017?

Where this fits in the Web App Fundamentals exam

More free Common Web Vulnerabilities (OWASP Intro) questions

One question down. Thousands to go.