Weaknesses of type CWE-942

117 results

Política de segurança entre domínios permissiva com domínios não confiáveis

A aplicação configura mecanismos de controle de acesso entre domínios (como CORS, crossdomain.xml ou equivalentes) de forma muito aberta, permitindo requisições de origens não verificadas ou wildcards. Isso expõe a aplicação a roubo de dados sensíveis, requisições não autorizadas e ataques de CSRF sofisticados, pois qualquer domínio malicioso consegue acessar recursos protegidos.

Example

Um servidor API configura `Access-Control-Allow-Origin: *` sem validar a origem, ou declara um arquivo crossdomain.xml aceitando `<allow-access-from domain="*" />`. Um atacante hospeda um site malicioso que faz fetch para a API e rouba tokens de sessão ou dados do usuário logado no navegador.

How to mitigate

Whitelist explícita: configure CORS ou crossdomain apenas com domínios conhecidos e confiáveis (ex: `Access-Control-Allow-Origin: https://seu-dominio.com`). Valide a origem da requisição no servidor antes de autorizar, nunca use wildcards (*) para recursos sensíveis, e implemente verificações adicionais como SameSite cookies e CSRF tokens.

CVE-2026-22812HIGHOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionEPSS 17.0%CVE-2023-38122HIGHInductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution VulnerabilityEPSS 1.9%CVE-2019-14860HIGHIt was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lackEPSS 1.2%CVE-2023-38125HIGHSofting edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-31736CRITICALA malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects ThunderEPSS 1.1%CVE-2020-36851CRITICALRob--W cors-anywhere Misconfigured CORS Proxy Allows SSRFEPSS 1.0%CVE-2023-46281HIGHA vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIEPSS 0.9%CVE-2022-26969CRITICALIn Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.EPSS 0.9%CVE-2024-21382MEDIUMMicrosoft Edge for Android Information Disclosure VulnerabilityEPSS 0.9%CVE-2026-54753MEDIUMNx: `nx graph` dev server permissive CORS policyEPSS 0.8%CVE-2024-41657HIGHGHSL-2024-035: Casdoor CORS misconfigurationEPSS 0.8%CVE-2026-56076HIGHPraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointEPSS 0.7%CVE-2022-47717HIGHLast Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).EPSS 0.7%CVE-2023-36829MEDIUMSentry CORS misconfiguration vulnerabilityEPSS 0.7%CVE-2024-25124CRITICALFiber has Insecure CORS Configuration, Allowing Wildcard Origin with CredentialsEPSS 0.7%CVE-2024-41659HIGHGHSL-2024-034: memos CORS Misconfiguration in server.goEPSS 0.6%CVE-2023-46098HIGHA vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, EPSS 0.6%CVE-2021-34435—In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the EPSS 0.6%CVE-2021-27786MEDIUMHCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin TrustedEPSS 0.6%CVE-2024-53276MEDIUMGHSL-2024-092: Open CORS policy in home-galleryEPSS 0.5%