Weaknesses of type CWE-424

49 results

Proteção inadequada de caminhos alternativos

É quando a aplicação ou sistema protege um caminho de acesso (rota, endpoint, arquivo), mas deixa aberta uma rota alternativa que leva ao mesmo recurso sem as mesmas verificações de segurança. O atacante contorna a proteção usando a via não defendida.

Example

Um sistema bloqueia acesso a /admin/users, mas a mesma funcionalidade está acessível via /admin/../users ou através de um parâmetro não sanitizado que redireciona internamente. Ou um WAF bloqueia a requisição POST, mas a aplicação aceita PUT para a mesma ação.

How to mitigate

Identifique todos os caminhos que levam ao mesmo recurso (aliases, redirects, métodos HTTP alternativos, path traversal) e aplique as mesmas regras de acesso em todas elas. Não confie em validação apenas no endpoint principal — valide na lógica de negócio também.

CVE-2024-58136CRITICALYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iEPSS 87.8%KEVCVE-2025-48827CRITICALvBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningEPSS 75.6%CVE-2025-48828CRITICALCertain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By cEPSS 57.3%CVE-2019-18997MEDIUMPB610 HMISimulator provides interface with access to arbitrary filesEPSS 1.5%CVE-2023-20272MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplEPSS 0.9%CVE-2026-66756MEDIUMApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseEPSS 0.7%CVE-2021-3793MEDIUMAn improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated EPSS 0.7%CVE-2026-82754MEDIUMash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsEPSS 0.7%CVE-2026-114659HIGHGrav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesEPSS 0.6%CVE-2024-8311MEDIUMImproper Protection of Alternate Path in GitLabEPSS 0.6%CVE-2026-4913MEDIUMImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenEPSS 0.6%CVE-2026-82586HIGHAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesEPSS 0.5%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.5%CVE-2026-86145HIGHPCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching worksEPSS 0.4%CVE-2024-3927MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassEPSS 0.4%CVE-2019-18996HIGHABB PB610 HMIStudio accepts malicious DLL file in an applicationEPSS 0.4%CVE-2026-76529CRITICALImproper Protection of Alternate Path in Splunk SOAREPSS 0.4%CVE-2026-69979MEDIUMWindows AppX Deployment Service Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-89039MEDIUMArbitrary file read via the convert_playwright_script prompt in mcp-k6EPSS 0.4%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%