Weaknesses of type CWE-346

696 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2023-30196HIGHPrestashop salesbooster <= 1.10.4 is vulnerable to Incorrect Access Control via modules/salesbooster/downloads/download.php.EPSS 0.5%CVE-2023-32553—An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certainEPSS 0.5%CVE-2024-14006HIGHNagios XI < 2024R1.2.2 Host Header InjectionEPSS 0.5%CVE-2026-89058HIGHResteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configEPSS 0.5%CVE-2026-16745HIGHOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validationEPSS 0.5%CVE-2025-21497MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8EPSS 0.5%CVE-2024-26135HIGHMeshCentral cross-site websocket hijacking (CSWSH) vulnerabilityEPSS 0.5%CVE-2023-27745HIGHAn issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actionEPSS 0.5%CVE-2026-69877MEDIUMAzure DevOps Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-7978MEDIUMInsufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to eEPSS 0.5%CVE-2020-26251MEDIUMCORS configuration is possibly vulnerableEPSS 0.5%CVE-2023-29867MEDIUMZammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accountsEPSS 0.5%CVE-2024-1249HIGHKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosEPSS 0.4%CVE-2022-42927HIGHA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.EPSS 0.4%CVE-2022-3457LOWOrigin Validation Error in ikus060/rdiffwebEPSS 0.4%CVE-2019-25211CRITICALparseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.comEPSS 0.4%CVE-2026-57989HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-30996MEDIUMIBM Cognos Analytics cross-origin resource sharingEPSS 0.4%CVE-2024-32764CRITICALmyQNAPcloud LinkEPSS 0.4%CVE-2026-59971CRITICALMySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)EPSS 0.4%