Fallos del tipo CWE-178

117 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Fraqueza onde o software não valida ou compara corretamente strings levando em conta diferenças entre maiúsculas e minúsculas, quando deveria fazê-lo (ou vice-versa). Um atacante pode contornar validações, acessar recursos não autorizados ou disparar comportamentos inesperados ao explorar inconsistências no tratamento de caso.

Ejemplo

Um WAF bloqueia requisições com a URL '/admin/users', mas um atacante consegue acessar '/Admin/Users' ou '/ADMIN/USERS' porque a validação não é case-insensitive enquanto a lógica de roteamento do servidor é. Resultado: bypass de controle de acesso.

Cómo mitigar

Padronize todas as comparações de strings sensíveis (URLs, nomes de arquivo, identificadores de usuário) para um único case antes de validar ou comparar. Documente explicitamente em cada validação se o comportamento deve ser case-sensitive ou não, alinhando com a lógica real da aplicação.

CVE-2025-27636MEDIUMApache Camel: Camel Message Header Injection via Improper FilteringEPSS 97.1%CVE-2021-24347—SP Project & Document Manager <2 4.22 - Authenticated Shell UploadEPSS 54.1%CVE-2026-47323CRITICALApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringEPSS 19.6%CVE-2026-33691MEDIUMOWASP CRS: Whitespace padding in filenames bypasses file upload extension checksEPSS 3.8%CVE-2025-46701HIGHApache Tomcat: Security constraint bypass for CGI scriptsEPSS 3.1%CVE-2023-3545CRITICALChamilo LMS Htaccess File Upload Security BypassEPSS 2.4%CVE-2023-4759HIGHImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeEPSS 2.2%CVE-2026-40453CRITICALApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injectionEPSS 2.1%CVE-2004-2154CRITICALCUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a prinEPSS 2.1%CVE-2026-53595CRITICALFreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQLEPSS 1.9%CVE-2023-46218MEDIUMThis flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allEPSS 1.7%CVE-2026-58057LOWFlowise - Custom MCP Environment Variable Denylist Bypass via Case SensitivityEPSS 1.6%CVE-2002-0485HIGHNorton Anti-Virus (NAV) allows remote attackers to bypass content filtering via attachments whose Content-Type and Content-Disposition headeEPSS 1.5%CVE-2026-28292CRITICALsimple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCEEPSS 1.4%CVE-2021-39155HIGHAuthorization Policy Bypass Due to Case Insensitive Host ComparisonEPSS 1.2%CVE-2026-102131HIGHKiteworks Email Protection Gateway Improper Handling of Case SensitivityEPSS 1.2%CVE-2021-25920MEDIUMIn OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious userEPSS 1.1%CVE-2022-29604CRITICALAn issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a nEPSS 1.0%CVE-2026-80343HIGHApache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingEPSS 0.9%CVE-2026-73270HIGHhttpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemsEPSS 0.9%