Fallos del tipo CWE-178

85 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Fraqueza onde o software não valida ou compara corretamente strings levando em conta diferenças entre maiúsculas e minúsculas, quando deveria fazê-lo (ou vice-versa). Um atacante pode contornar validações, acessar recursos não autorizados ou disparar comportamentos inesperados ao explorar inconsistências no tratamento de caso.

Ejemplo

Um WAF bloqueia requisições com a URL '/admin/users', mas um atacante consegue acessar '/Admin/Users' ou '/ADMIN/USERS' porque a validação não é case-insensitive enquanto a lógica de roteamento do servidor é. Resultado: bypass de controle de acesso.

Cómo mitigar

Padronize todas as comparações de strings sensíveis (URLs, nomes de arquivo, identificadores de usuário) para um único case antes de validar ou comparar. Documente explicitamente em cada validação se o comportamento deve ser case-sensitive ou não, alinhando com a lógica real da aplicação.

CVE-2026-86770HIGHSnipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationEPSS 0.3%CVE-2026-15573HIGHKeycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherEPSS 0.3%CVE-2025-67718HIGHFormio improperly authorized permission elevation through specially crafted request pathEPSS 0.3%CVE-2026-84303MEDIUMgRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasionEPSS 0.3%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.3%CVE-2026-82726MEDIUMAshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenantEPSS 0.3%CVE-2026-83612HIGHxmldom: HTML raw-text closing-tag case mismatch causes output amplificationEPSS 0.3%CVE-2026-42273HIGHHeimdall: Case-sensitive host matching may lead to policy bypassEPSS 0.3%CVE-2026-84428HIGHfastify vulnerable to header validation bypass via incomplete schema case normalizationEPSS 0.3%CVE-2026-66883MEDIUMOidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookupEPSS 0.3%CVE-2026-8404LOWPotential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewareEPSS 0.3%CVE-2026-82067CRITICALImproper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at StartupEPSS 0.3%CVE-2026-71315HIGHNuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)EPSS 0.3%CVE-2026-27896HIGHMCP Go SDK Vulnerable to Improper Handling of Case SensitivityEPSS 0.3%CVE-2026-47346HIGHTYPO3 CMS - Broken Access Control in Form FrameworkEPSS 0.3%CVE-2026-44367LOWKlaw: user lockout due to case sensitivity inconsistencyEPSS 0.2%CVE-2026-70429HIGHJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeEPSS 0.2%CVE-2026-46392HIGHHAX CMS PHP Has a Stored XSS via Case-Sensitivity Mismatch in HTML Upload ValidationEPSS 0.2%CVE-2026-54763HIGHTraefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuthEPSS 0.2%CVE-2026-57234LOWNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247EPSS 0.2%