Fallos del tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

A aplicação não valida ou não implementa corretamente as permissões necessárias para acessar recursos sensíveis, permitindo que usuários realizem operações além do seu nível de privilégio autorizado. Isso pode expor dados confidenciais, modificar informações críticas ou comprometer a integridade do sistema.

Ejemplo

Um usuário comum consegue acessar diretamente uma rota administrativa (/admin/users) porque o backend não verifica se ele é administrador antes de executar a ação, apenas confiando que não tentaria; ou um processo de aplicação roda como root quando precisaria rodar como usuário não-privilegiado, ampliando o impacto de qualquer falha.

Cómo mitigar

Implemente validação de privilégios em todas as operações sensíveis (verificar permissões no servidor, nunca só no cliente), use princípio do menor privilégio (processos e contas com permissões mínimas necessárias), e mantenha matriz de controle de acesso (RBAC ou ABAC) consistente e auditada.

CVE-2018-0463—Cisco Network Services Orchestrator Network Plug and Play Information Disclosure VulnerabilityEPSS 1.5%CVE-2017-7916—A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFEPSS 1.5%CVE-2020-3112HIGHCisco Data Center Network Manager Privilege Escalation VulnerabilityEPSS 1.5%CVE-2017-6624—A vulnerability in Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME) could allow an unauthenticated, remote attacker to make uEPSS 1.4%CVE-2019-1969MEDIUMCisco NX-OS Software SNMP Access Control List Configuration Name Bypass VulnerabilityEPSS 1.4%CVE-2018-0096—A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attEPSS 1.4%CVE-2019-17326—ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a speciaEPSS 1.3%CVE-2019-19106CRITICALABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issuesEPSS 1.3%CVE-2019-15272MEDIUMCisco Unified Communications Manager Security Bypass VulnerabilityEPSS 1.3%CVE-2022-34149CRITICALWordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerabilityEPSS 1.3%CVE-2019-15960MEDIUMCisco Webex Network Recording Admin Page Privilege Escalation VulnerabilityEPSS 1.3%CVE-2019-1906MEDIUMCisco Prime Infrastructure Virtual Domain Privilege Escalation VulnerabilityEPSS 1.3%CVE-2022-36375HIGHWordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2022-33969HIGHWordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2019-17322—ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to EPSS 1.2%CVE-2022-33970HIGHWordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerabilityEPSS 1.1%CVE-2022-34868HIGHWordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerabilityEPSS 1.1%CVE-2022-29423LOWWordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerabilityEPSS 1.1%CVE-2019-1981MEDIUMCisco Firepower Threat Defense Software NULL Character Obfuscation Detection Bypass VulnerabilityEPSS 1.0%CVE-2018-0089—A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attaEPSS 1.0%