Fallos del tipo CWE-178

117 resultados

Tratamento inadequado de sensibilidade a maiúsculas/minúsculas

Fraqueza onde o software não valida ou compara corretamente strings levando em conta diferenças entre maiúsculas e minúsculas, quando deveria fazê-lo (ou vice-versa). Um atacante pode contornar validações, acessar recursos não autorizados ou disparar comportamentos inesperados ao explorar inconsistências no tratamento de caso.

Ejemplo

Um WAF bloqueia requisições com a URL '/admin/users', mas um atacante consegue acessar '/Admin/Users' ou '/ADMIN/USERS' porque a validação não é case-insensitive enquanto a lógica de roteamento do servidor é. Resultado: bypass de controle de acesso.

Cómo mitigar

Padronize todas as comparações de strings sensíveis (URLs, nomes de arquivo, identificadores de usuário) para um único case antes de validar ou comparar. Documente explicitamente em cada validação se o comportamento deve ser case-sensitive ou não, alinhando com a lógica real da aplicação.

CVE-2026-105608HIGHConsul vulnerable to an authorization bypass in service mesh registrationEPSS 0.5%CVE-2025-4035MEDIUMLibsoup: cookie domain validation bypass via uppercase characters in libsoupEPSS 0.4%CVE-2026-100669HIGHGrav before 2.0.25 Sensitive File Disclosure via Case-Variation BypassEPSS 0.4%CVE-2026-15617CRITICALPrincipal/domain lookup without case normalizationEPSS 0.4%CVE-2026-27588HIGHCaddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassEPSS 0.4%CVE-2026-27587HIGHCaddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassEPSS 0.4%CVE-2026-114132MEDIUMNuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitiveEPSS 0.4%CVE-2025-61593HIGHCursor CLI Agent: Sensitive File Overwrite BypassEPSS 0.4%CVE-2026-70429HIGHJenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackeEPSS 0.4%CVE-2026-48794LOWAuthelia has an Edge Case Access Control Rule MismatchEPSS 0.4%CVE-2024-55634HIGHDrupal core - Moderately critical - Access bypass - SA-CORE-2024-004EPSS 0.4%CVE-2026-92700MEDIUMCaddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationEPSS 0.4%CVE-2026-54528HIGHjupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded DirectoriesEPSS 0.4%CVE-2026-53721HIGHNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherEPSS 0.4%CVE-2026-42272HIGHHeimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretationEPSS 0.4%CVE-2026-62230HIGHGrav < 2.0.4 File Access Bypass via Case VariationEPSS 0.4%CVE-2026-14617LOWNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityEPSS 0.4%CVE-2024-38829LOWSpring LDAP sensitive data exposure for case-sensitive comparisonsEPSS 0.4%CVE-2026-116469HIGHMISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingEPSS 0.4%CVE-2026-78959MEDIUMImproper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engiEPSS 0.4%