Fallos del tipo CWE-1023
24 resultadosComparação incompleta com fatores faltantes
Ocorre quando uma comparação de segurança verifica apenas alguns dos fatores relevantes, ignorando outros que deveriam ser validados. Isso deixa brechas lógicas que um atacante explora contornando a proteção parcial implementada.
Ejemplo
Um sistema valida se um usuário está autenticado (token válido) mas não verifica se a sessão expirou ou se as permissões foram revogadas. Um invasor usa um token antigo já desativado para acessar recursos porque a comparação foi incompleta.
Cómo mitigar
Enumere explicitamente todos os fatores que devem ser validados (autenticação, expiração, permissões, roles, contexto). Implemente testes unitários que tentam contornar cada fator isoladamente e use princípio de falha segura — rejeite a menos que todos os critérios passem.
CVE-2026-7473MEDIUMArista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassEPSS 1.1%KEVCVE-2026-81376CRITICALVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.9%CVE-2021-23146HIGHAn Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This EPSS 0.9%CVE-2025-55333MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.8%CVE-2026-24255HIGHNVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitEPSS 0.5%CVE-2026-4599CRITICALVersions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandoEPSS 0.5%CVE-2026-54713LOWCakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisionsEPSS 0.5%CVE-2024-5528LOWIncomplete Comparison with Missing Factors in GitLabEPSS 0.4%CVE-2026-91768MEDIUMIPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)EPSS 0.4%CVE-2026-48587LOWPotential exposure of private data via whitespace padding in Vary headerEPSS 0.4%CVE-2026-85491HIGHCatalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path aloneEPSS 0.4%CVE-2026-48761MEDIUMSymfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> contentEPSS 0.3%CVE-2026-121564LOWSilent loss of messages when merging overlapping chat exports in whatstkEPSS 0.3%CVE-2025-46722MEDIUMvLLM has a Weakness in MultiModalHasher Image Hashing ImplementationEPSS 0.3%CVE-2026-91836LOWOpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factorsEPSS 0.3%CVE-2026-14199HIGHSession takeover via Auth Proxy cache key collisionEPSS 0.3%CVE-2026-54181MEDIUMbackpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedEPSS 0.3%CVE-2026-92611MEDIUMIn Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard EPSS 0.3%CVE-2026-53839MEDIUMOpenClaw < 2026.5.7 - Hostname Prefix Matching Bypass in Trusted Retry Endpoint ValidationEPSS 0.3%CVE-2026-4748HIGHpf silently ignores certain rulesEPSS 0.3%