Weaknesses of type CWE-178

87 results

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

O código não trata corretamente a diferença entre letras maiúsculas e minúsculas em validações, comparações ou operações de segurança. Um atacante pode contornar filtros ou controles de acesso usando variações de caso (exemplo: 'Admin' em vez de 'admin'), já que a aplicação não normaliza ou compara corretamente as strings.

Example

Um sistema valida nomes de arquivo para bloquear '.exe', mas aceita '.EXE' ou '.Exe' porque a verificação é case-sensitive. Ou um WAF bloqueia a palavra-chave 'union' em SQL, mas o atacante injeta 'UnIoN' e consegue contornar o filtro.

How to mitigate

Normalize sempre para um único case (tipicamente minúsculas) antes de comparar strings em contextos de segurança. Use funções de comparação case-insensitive ou converta explicitamente com toLowerCase()/toUpperCase() antes de validações, filtros e controles de acesso.

CVE-2024-55634HIGHDrupal core - Moderately critical - Access bypass - SA-CORE-2024-004EPSS 0.4%CVE-2026-72836CRITICALFileBrowser before 2.63.19 Case Sensitivity Authentication BypassEPSS 0.4%CVE-2025-61593HIGHCursor CLI Agent: Sensitive File Overwrite BypassEPSS 0.4%CVE-2026-54528HIGHjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded DirectoriesEPSS 0.4%CVE-2026-87876LOWCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)EPSS 0.4%CVE-2026-53721HIGHNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherEPSS 0.4%CVE-2026-42272HIGHHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationEPSS 0.4%CVE-2026-78959MEDIUMImproper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engiEPSS 0.4%CVE-2025-59944HIGHCursor IDE: Sensitive File Overwrite Bypass is PossibleEPSS 0.4%CVE-2026-14617LOWNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityEPSS 0.4%CVE-2024-38829LOWSpring LDAP sensitive data exposure for case-sensitive comparisonsEPSS 0.4%CVE-2026-27587HIGHCaddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassEPSS 0.4%CVE-2026-27588HIGHCaddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassEPSS 0.4%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.4%CVE-2026-15617CRITICALPrincipal/domain lookup without case normalizationEPSS 0.4%CVE-2026-90982MEDIUM@fastify/static vulnerable to route guard bypass via path case-foldingEPSS 0.4%CVE-2026-55170LOWOpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisionsEPSS 0.3%CVE-2026-89012HIGHDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterEPSS 0.3%CVE-2026-25889MEDIUMFile Browser has an Authentication Bypass in User Password UpdateEPSS 0.3%CVE-2026-77560HIGHTinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist forEPSS 0.3%