Fallos del tipo CWE-1327

33 resultados

Vinculação a endereço IP irrestrito

Ocorre quando uma aplicação se vincula a 0.0.0.0 ou :: (IPv6) sem restrição, expondo serviços internos à rede inteira ou à internet. O problema é que o desenvolvedor não restringe quem pode acessar o serviço, tornando-o acessível de qualquer origem quando não deveria estar.

Ejemplo

Um servidor de debug ou ferramenta administrativa vincula-se a 0.0.0.0:9200 durante o desenvolvimento e vai para produção assim, permitindo que qualquer pessoa na rede (ou internet, se exposto) acesse funcionalidades sensíveis sem autenticação ou com controles fracos.

Cómo mitigar

Vincule serviços apenas a localhost (127.0.0.1 ou ::1) se forem locais, ou a IPs específicos e privados se precisarem ser acessíveis internamente. Se for expor na rede, combine com autenticação forte, firewall e controle de acesso na camada de rede.

CVE-2025-11538MEDIUMKeycloak-server: debug default bind addressEPSS 0.4%CVE-2022-29820LOWIn JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possibleEPSS 0.4%CVE-2025-55322HIGHOmniParser Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-119249HIGHA malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop toEPSS 0.3%CVE-2026-55641HIGH9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRFEPSS 0.3%CVE-2026-0481CRITICALUnrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized chEPSS 0.3%CVE-2026-47873HIGHSpring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesEPSS 0.3%CVE-2026-72924LOWGitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by defaultEPSS 0.3%CVE-2026-108760HIGHLlamaFarm through 0.0.34 Unauthenticated API Exposed on All InterfacesEPSS 0.2%CVE-2024-49384LOWExcessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products are affected: AcroniEPSS 0.2%CVE-2024-49382LOWExcessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products are affected: AcroniEPSS 0.2%CVE-2024-49383LOWExcessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products are affected: AcronisEPSS 0.2%CVE-2026-42503HIGHAccidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/goplsEPSS 0.2%