Fallos del tipo CWE-284

7967 resultados

Controle de acesso insuficiente ou ausente

A aplicação não valida corretamente quem pode acessar determinado recurso (arquivo, API, função, dados), permitindo que usuários não autorizados façam operações que deveriam estar bloqueadas. É um dos problemas mais comuns em segurança: sem autenticação e autorização robustas, qualquer um consegue fazer o que não deveria.

Ejemplo

Um admin panel acessível via /admin sem login real, ou uma API que retorna dados de qualquer usuário basta mudar um ID na URL sem verificar se você tem permissão. Outro caso: arquivo de configuração com credenciais exposto publicamente porque a aplicação não define permissões de leitura no servidor.

Cómo mitigar

Implemente autenticação forte (sessões, tokens JWT) e autorização em toda operação sensível — verifique explicitamente se o usuário logado tem permissão antes de retornar dados ou executar ações. Use listas de controle de acesso (ACL) ou Role-Based Access Control (RBAC), e nunca confie em IDs de usuário vindos do cliente sem validação server-side.

CVE-2023-2183MEDIUMGrafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel EPSS 1.0%CVE-2025-2549MEDIUMD-Link DIR-618/DIR-605L formSetPassword access controlEPSS 1.0%CVE-2017-8438—Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitionEPSS 1.0%CVE-2022-40798HIGHOcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request withEPSS 1.0%CVE-2024-24386HIGHAn issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.EPSS 1.0%CVE-2022-23730—The public API error causes for the attacker to be able to bypass API access control.EPSS 1.0%CVE-2023-39962HIGHUsers can delete external storage mount pointsEPSS 1.0%CVE-2025-46628HIGHLack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attackeEPSS 1.0%CVE-2023-24058MEDIUMBooked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservatioEPSS 1.0%CVE-2021-21965HIGHA denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34.EPSS 1.0%CVE-2022-32789MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferencEPSS 1.0%CVE-2020-8278—Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.EPSS 1.0%CVE-2022-23768HIGHNeo Information Sys. NIS-HAP11AC remote access and manipulation vulnerabilityEPSS 1.0%CVE-2024-13108MEDIUMD-Link DIR-816 A2 form2NetSniper.cgi access controlEPSS 1.0%CVE-2021-1478MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 1.0%CVE-2020-26072HIGHCisco IoT Field Network Director SOAP API Authorization Bypass VulnerabilityEPSS 1.0%CVE-2022-0731MEDIUMImproper Access Control (IDOR) in dolibarr/dolibarrEPSS 1.0%CVE-2024-26029HIGHAdobe Experience Manager | Improper Access Control (CWE-284)EPSS 1.0%CVE-2021-34754MEDIUMCisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass VulnerabilitiesEPSS 1.0%CVE-2023-40060HIGH2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1EPSS 1.0%