CISSP Software Development Security Practice Question
During a penetration test, a security analyst discovers that a web application allows an attacker to bypass authorization and view another user's private messages by simply changing a numeric ID in the URL. Which vulnerability is being exploited?
⚠ Common exam trap
A common mix-up: candidates confuse IDOR with broken authentication because both involve unauthorized access, but IDOR specifically targets direct object references without proper access controls, whereas broken authentication focuses on flaws in the authentication process itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure direct object reference (IDOR)
B is correct because the vulnerability allows an attacker to access another user's private messages by simply changing a numeric ID in the URL, which is a classic example of Insecure Direct Object Reference (IDOR). This occurs when the application exposes a direct reference to an internal object (e.g., a database key) without proper access control checks, enabling unauthorized access to resources belonging to other users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Broken authentication
Why it's wrong here
Broken authentication refers to vulnerabilities in how an application manages user identities, login credentials, and session tokens. This could manifest as weak password policies, improper session invalidation, or susceptibility to brute-force attacks. While critical for overall security, it doesn't directly describe a scenario where an authenticated user can access another user's resources simply by changing an object identifier in a request without proper authorization checks.
- ✓
Insecure direct object reference (IDOR)
Why this is correct
Insecure direct object reference (IDOR) occurs when an application exposes a direct reference to an internal implementation object, such as a file, database key, or directory, and fails to implement sufficient authorization checks. An attacker can manipulate these references, often found in URL parameters or request bodies, to access or modify resources belonging to other users or system components without explicit permission. This directly aligns with a penetration test discovery where an analyst accesses unauthorized objects by altering an identifier.
- ✗
Server-side request forgery (SSRF)
Why it's wrong here
Server-side request forgery (SSRF) is a vulnerability where an attacker can induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. This allows the attacker to force the server to connect to internal services within the organization's infrastructure or external third-party services. This differs from IDOR, which focuses on unauthorized direct access to application objects by manipulating identifiers, rather than coercing the server to initiate new, unauthorized network connections.
- ✗
Security misconfiguration
Why it's wrong here
Security misconfiguration encompasses a broad range of vulnerabilities resulting from improperly configured security settings across the application stack, including web servers, application servers, databases, and frameworks. Examples include using default credentials, enabling unnecessary features, verbose error messages revealing sensitive information, or inadequate access controls on directories. While IDOR can sometimes stem from a misconfiguration of authorization rules, the core issue of directly referencing objects without proper checks is more specifically categorized as IDOR itself, rather than a general misconfiguration.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Authorization
Authorization determines what an authenticated user is allowed to do within a system, such as accessing files, running programs, or changing settings.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.