Weaknesses of type CWE-942

149 results

Política de segurança entre domínios permissiva com domínios não confiáveis

A aplicação configura mecanismos de controle de acesso entre domínios (como CORS, crossdomain.xml ou equivalentes) de forma muito aberta, permitindo requisições de origens não verificadas ou wildcards. Isso expõe a aplicação a roubo de dados sensíveis, requisições não autorizadas e ataques de CSRF sofisticados, pois qualquer domínio malicioso consegue acessar recursos protegidos.

Example

Um servidor API configura `Access-Control-Allow-Origin: *` sem validar a origem, ou declara um arquivo crossdomain.xml aceitando `<allow-access-from domain="*" />`. Um atacante hospeda um site malicioso que faz fetch para a API e rouba tokens de sessão ou dados do usuário logado no navegador.

How to mitigate

Whitelist explícita: configure CORS ou crossdomain apenas com domínios conhecidos e confiáveis (ex: `Access-Control-Allow-Origin: https://seu-dominio.com`). Valide a origem da requisição no servidor antes de autorizar, nunca use wildcards (*) para recursos sensíveis, e implemente verificações adicionais como SameSite cookies e CSRF tokens.

CVE-2025-9292LOWPermissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud ControllersEPSS 0.4%CVE-2026-63407HIGHGrav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API ResponsesEPSS 0.4%CVE-2025-30354HIGHBruno ignores Safe-Mode in Asserts expressionsEPSS 0.4%CVE-2026-34200HIGHNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network PortEPSS 0.4%CVE-2023-23128MEDIUMConnectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have EPSS 0.4%CVE-2025-41366MEDIUMCORS vulnerability in IDF and ZLFEPSS 0.4%CVE-2026-15966HIGHImproper CORS handling in MOVEit TransferEPSS 0.4%CVE-2026-66070HIGHRabbitMQ: CORS * reflects Origin with Allow-CredentialsEPSS 0.4%CVE-2023-45213MEDIUM Westermo Lynx Permissive Cross-domain Policy with Untrusted DomainsEPSS 0.4%CVE-2024-22348MEDIUMIBM UrbanCode Velocity cross-origin resource sharingEPSS 0.4%CVE-2026-74881HIGHopenssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard OriginsEPSS 0.4%CVE-2025-4515MEDIUMZylon PrivateGPT settings.yaml cross-domain policyEPSS 0.4%CVE-2026-107858HIGHCross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development ServerEPSS 0.4%CVE-2025-61163CRITICALCohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the servEPSS 0.4%CVE-2026-33043HIGHAVideo affected by Session Hijacking via Unauthenticated Session ID Disclosure with Permissive CORSEPSS 0.4%CVE-2026-70604HIGHElectron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsEPSS 0.4%CVE-2026-32610HIGHGlances's Default CORS Configuration Allows Cross-Origin Credential TheftEPSS 0.4%CVE-2024-6449MEDIUMArbitrary cross-domain file inclusion in HyperView Geoportal ToolkitEPSS 0.4%CVE-2026-1181CRITICALAltium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace AccessEPSS 0.4%CVE-2026-33533HIGHGlances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS WildcardEPSS 0.3%