Weaknesses of type CWE-346

588 results

Validação incorreta de origem em requisições cross-origin

A aplicação falha em validar corretamente a origem (domínio) de requisições HTTP, especialmente em cenários de CORS (Cross-Origin Resource Sharing) ou WebSockets. Um atacante pode contornar controles de segurança e executar ações em nome do usuário legítimo, ou acessar dados sensíveis que deveriam estar protegidos.

Example

Um banco implementa CORS permitindo qualquer origem (`Access-Control-Allow-Origin: *`) ou valida o header `Origin` de forma fraca (aceitando subdomínios descontrolados). Um site malicioso faz requisições ao banco em background enquanto o usuário está logado, roubando dados ou transferindo dinheiro.

How to mitigate

Valide a origem contra uma lista branca explícita de domínios confiáveis; implemente SameSite cookies; use tokens CSRF + verificação de origin no servidor; evite `Access-Control-Allow-Origin: *` em APIs sensíveis; valide o header `Origin` exatamente, sem wildcards ou regex permissivo.

CVE-2024-41475CRITICALGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.EPSS 0.3%CVE-2025-71217HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to eEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2024-5549HIGHData leak through CORS misconfiguration in stitionai/devikaEPSS 0.3%CVE-2026-57989HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-8487HIGHCORS Vulnerability in modelscope/agentscopeEPSS 0.3%CVE-2025-4839LOWitwanger paicoding CrossUtil.java cross-domain policyEPSS 0.3%CVE-2022-29915MEDIUMThe Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affectEPSS 0.3%CVE-2023-37210—A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoEPSS 0.3%CVE-2026-17743MEDIUMInsufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2026-17754MEDIUMInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a cEPSS 0.3%CVE-2026-17748MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-17787MEDIUMInappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.3%CVE-2026-17763MEDIUMInappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2026-17815MEDIUMInsufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-17742MEDIUMInsufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17733MEDIUMInappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17820MEDIUMInsufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17765MEDIUMInappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-17829MEDIUMInsufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%