Fallos del tipo CWE-178

117 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Fraqueza onde o software não valida ou compara corretamente strings levando em conta diferenças entre maiúsculas e minúsculas, quando deveria fazê-lo (ou vice-versa). Um atacante pode contornar validações, acessar recursos não autorizados ou disparar comportamentos inesperados ao explorar inconsistências no tratamento de caso.

Ejemplo

Um WAF bloqueia requisições com a URL '/admin/users', mas um atacante consegue acessar '/Admin/Users' ou '/ADMIN/USERS' porque a validação não é case-insensitive enquanto a lógica de roteamento do servidor é. Resultado: bypass de controle de acesso.

Cómo mitigar

Padronize todas as comparações de strings sensíveis (URLs, nomes de arquivo, identificadores de usuário) para um único case antes de validar ou comparar. Documente explicitamente em cada validação se o comportamento deve ser case-sensitive ou não, alinhando com a lógica real da aplicação.

CVE-2026-62673HIGHGrav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsEPSS 0.5%CVE-2026-29054HIGHTraefik: lowercase `Connection` tokens can delete traefik-managed forwarded identity headers (for example, `X-Real-Ip`)EPSS 0.5%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2026-83612HIGHxmldom: HTML raw-text closing-tag case mismatch causes output amplificationEPSS 0.5%CVE-2026-82726MEDIUMAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantEPSS 0.5%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.5%CVE-2025-59944HIGHCursor IDE: Sensitive File Overwrite Bypass is PossibleEPSS 0.5%CVE-2026-82067CRITICALImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupEPSS 0.5%CVE-2026-43513HIGHApache Tomcat: LockOutRealm treats user names as case-sensitiveEPSS 0.5%CVE-2025-50864MEDIUMAn Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictionEPSS 0.5%CVE-2026-106503HIGHBackstage: Scaffolder action input authorization bypassEPSS 0.5%CVE-2026-77281MEDIUMCaddy: rewrite placeholder re-expansionEPSS 0.5%CVE-2026-48595HIGHAuthorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirectsEPSS 0.5%CVE-2026-32939HIGHDataEase is Vulnerable to H2 JDBC RCE BypassEPSS 0.5%CVE-2026-107381MEDIUMsvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesEPSS 0.5%CVE-2026-71315HIGHNuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)EPSS 0.5%CVE-2026-89012HIGHDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterEPSS 0.5%CVE-2026-15573HIGHKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherEPSS 0.5%CVE-2026-74041HIGHWazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case MismatchEPSS 0.5%CVE-2026-47203LOWAuthelia Missing Username Canonicalization in Basic Auth (LDAP)EPSS 0.5%