Weaknesses of type CWE-284

7,967 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2024-23315HIGHA read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550EEPSS 1.0%CVE-2024-40786HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, mEPSS 1.0%CVE-2023-23923—Moodle: possible to set the preferred "start page" of other usersEPSS 1.0%CVE-2023-22250MEDIUMAdobe Commerce Improper Access Control Security feature bypassEPSS 1.0%CVE-2018-16466—Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acEPSS 1.0%CVE-2022-26317—A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completeEPSS 1.0%CVE-2023-36644HIGHIncorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the EPSS 1.0%CVE-2024-2481MEDIUMSurya2Developer Hostel Management System manage-students.php access controlEPSS 1.0%CVE-2025-7075MEDIUMBlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted uploadEPSS 1.0%CVE-2024-38164CRITICALGroupMe Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2023-48239HIGHNextcloud Server users can make external storage mount points inaccessible for other usersEPSS 0.9%CVE-2019-10175MEDIUMA flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determEPSS 0.9%CVE-2022-25627MEDIUMAn authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in SyEPSS 0.9%CVE-2020-3565MEDIUMCisco Firepower Threat Defense Software TCP Intercept Bypass VulnerabilityEPSS 0.9%CVE-2023-25821MEDIUMNextcloud download permissions can be changed by resharerEPSS 0.9%CVE-2021-23233HIGHFresenius Kabi Agilia Connect Infusion System EPSS 0.9%CVE-2024-0795HIGHCreate user API role not enforced EPSS 0.9%CVE-2021-34794MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control VulnerabilityEPSS 0.9%CVE-2024-38204HIGHImagine Cup site Information Disclosure VulnerabilityEPSS 0.9%CVE-2021-28798HIGHRelative Path Traversal Vulnerability in QTS and QuTS heroEPSS 0.9%