Fallos del tipo CWE-1021
234 resultadosImplementação inadequada de requisito de segurança
É quando um desenvolvedor implementa um controle de segurança ou funcionalidade crítica de forma incompleta, incorreta ou desalinhada com a intenção original. O código executa, mas não protege contra a ameaça que deveria, deixando brechas exploráveis.
Ejemplo
Um sistema implementa validação de entrada verificando apenas letras, mas esquece de validar tamanho máximo de string. Um atacante envia um payload gigante que causa buffer overflow apesar da validação existir.
Cómo mitigar
Revise a especificação de segurança contra a implementação real (code review com foco em completude). Use testes de segurança específicos (fuzzing, testes de limite) antes de deploy, não confie que 'parece estar protegido'.
CVE-2019-7393—A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.EPSS 2.3%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.9%CVE-2022-2179MEDIUMICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesEPSS 1.7%CVE-2022-42799MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 anEPSS 1.7%CVE-2022-1803HIGHImproper Restriction of Rendered UI Layers or Frames in polonel/trudeskEPSS 1.6%CVE-2021-3799MEDIUMImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminEPSS 1.6%CVE-2022-46695MEDIUMA spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2,EPSS 1.4%CVE-2023-1362HIGHImproper Restriction of Rendered UI Layers or Frames in unilogies/bumsysEPSS 1.4%CVE-2021-3660—Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anotEPSS 1.3%CVE-2021-3731MEDIUMImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbEPSS 1.2%CVE-2022-3167CRITICALImproper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebEPSS 1.2%CVE-2020-28218—A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would aEPSS 1.1%CVE-2023-41897HIGHLack of XFO header allows clickjacking in Home Assistant CoreEPSS 1.1%CVE-2017-16775HIGHImproper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote atEPSS 1.1%CVE-2021-35237MEDIUMClickjacking VulnerabilityEPSS 1.0%CVE-2022-22807—A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the producEPSS 0.9%CVE-2024-26167MEDIUMMicrosoft Edge for Android Spoofing VulnerabilityEPSS 0.9%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.8%CVE-2022-45418MEDIUMIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting inEPSS 0.8%