Weaknesses of type CWE-915

205 results

Modificação descontrolada de atributos de objetos determinados dinamicamente

A aplicação permite que um atacante modifique atributos de um objeto através de entrada do usuário sem validação adequada, porque o nome ou referência do atributo é construído dinamicamente a partir de dados não confiáveis. Isso pode levar a lógica de negócio comprometida, bypass de controles de acesso ou alteração de dados sensíveis.

Example

Um sistema web usa reflection ou mapeamento automático para atribuir parâmetros HTTP diretamente a propriedades de um objeto modelo (ex: `user.__proto__.isAdmin = true`). Um atacante envia `isAdmin=true` ou manipula o protótipo do objeto, escalando seus privilégios sem autenticação apropriada.

How to mitigate

Implemente um whitelist explícito de atributos que podem ser modificados dinamicamente, nunca permita entrada do usuário determinar diretamente qual propriedade será alterada. Desabilite reflection ou mapeamento automático em camadas sensíveis, e valide rigorosamente tipos e valores antes de qualquer atribuição.

CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.1%CVE-2022-31106HIGHPrototype Pollution in underscore.deepEPSS 1.1%CVE-2026-78416HIGHAuthenticated RCE via `condition.config` JSON cleanse bypassEPSS 1.0%CVE-2026-59721HIGHHoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injectionEPSS 1.0%CVE-2026-29063HIGHImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableEPSS 1.0%CVE-2024-55638CRITICALDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-008EPSS 1.0%CVE-2024-3283HIGHPrivilege Escalation via Mass Assignment in mintplex-labs/anything-llmEPSS 0.9%CVE-2024-55636CRITICALDrupal core - Less critical - Gadget chain - SA-CORE-2024-006EPSS 0.9%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2026-46625HIGHJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionEPSS 0.9%CVE-2026-42033HIGHAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingEPSS 0.9%CVE-2023-32079HIGHNetmaker Privilige Escalation VulnerabilityEPSS 0.9%CVE-2026-33228HIGHflatted: Prototype Pollution via parse()EPSS 0.9%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.9%CVE-2026-5708HIGHImproper Control of User-Modifiable Attributes in RES CreateSession APIEPSS 0.9%CVE-2024-55637CRITICALDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-007EPSS 0.8%CVE-2025-69690CRITICALNetgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the EPSS 0.8%CVE-2026-72778HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configEPSS 0.8%CVE-2026-42264HIGHAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingEPSS 0.8%CVE-2026-84645HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confiEPSS 0.8%