Fallos del tipo CWE-283

23 resultados

Propriedade não verificada

Uma aplicação assume que um recurso (arquivo, diretório, processo, conexão) pertence a quem deveria, sem validar de fato. Isso permite que um atacante substitua o recurso por outro sob seu controle e execute ações com privilégios maiores ou acesse dados sensíveis.

Ejemplo

Um script administrativo tenta modificar um arquivo de configuração em /tmp/config.ini sem verificar quem o criou ou se é um link simbólico. Um usuário malicioso cria um link para /etc/passwd apontado por esse caminho, e o script sobrescreve o arquivo do sistema com dados controlados pelo atacante.

Cómo mitigar

Sempre valide propriedade e permissões antes de operar um recurso: use fstat() ou stat() para verificar UID/GID, evite /tmp para arquivos críticos, e desabilite seguimento de symlinks em operações sensíveis. Aplique princípio do menor privilégio ao executar código que manipula recursos.

CVE-2020-8554MEDIUMKubernetes man in the middle using LoadBalancer or ExternalIPsEPSS 9.3%CVE-2024-27903HIGHOpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitraryEPSS 8.9%CVE-2021-24501—Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsEPSS 1.3%CVE-2021-24500—Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesEPSS 0.6%CVE-2025-1007MEDIUMImproper Authorization in /user/namespace/{namespace}/detailsEPSS 0.5%CVE-2022-29220MEDIUMNo verification of commits origin in github-action-merge-dependabotEPSS 0.5%CVE-2023-30544LOWKiwi TCMS may allow user to update email address to unverified oneEPSS 0.4%CVE-2026-20912CRITICALGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureEPSS 0.4%CVE-2025-47940HIGHTYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerEPSS 0.4%CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2023-6068LOWOn affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and someEPSS 0.3%CVE-2025-36091MEDIUMIBM Business Automation Insights unverified ownershipEPSS 0.3%CVE-2026-26016CRITICALPterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing AuthorizationEPSS 0.3%CVE-2026-27486MEDIUMOpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process CleanupEPSS 0.3%CVE-2025-12815MEDIUMAn ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.EPSS 0.3%CVE-2026-44562MEDIUMOpen WebUI: Model Import Overwrites Any Model Without Ownership CheckEPSS 0.3%CVE-2026-29788HIGHTSPortal: Anyone can forge self-deletion requests of any userEPSS 0.3%CVE-2026-4269MEDIUMImproper S3 ownership verification in Bedrock AgentCore Starter ToolkitEPSS 0.2%CVE-2025-9822MEDIUMSecret data extraction via elfinderEPSS 0.2%CVE-2026-0598MEDIUMAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiEPSS 0.2%