Fallos del tipo CWE-284

7967 resultados

Controle de acesso insuficiente ou ausente

A aplicação não valida corretamente quem pode acessar determinado recurso (arquivo, API, função, dados), permitindo que usuários não autorizados façam operações que deveriam estar bloqueadas. É um dos problemas mais comuns em segurança: sem autenticação e autorização robustas, qualquer um consegue fazer o que não deveria.

Ejemplo

Um admin panel acessível via /admin sem login real, ou uma API que retorna dados de qualquer usuário basta mudar um ID na URL sem verificar se você tem permissão. Outro caso: arquivo de configuração com credenciais exposto publicamente porque a aplicação não define permissões de leitura no servidor.

Cómo mitigar

Implemente autenticação forte (sessões, tokens JWT) e autorização em toda operação sensível — verifique explicitamente se o usuário logado tem permissão antes de retornar dados ou executar ações. Use listas de controle de acesso (ACL) ou Role-Based Access Control (RBAC), e nunca confie em IDs de usuário vindos do cliente sem validação server-side.

CVE-2023-26347HIGHCVE-2023-38205 issues | ColdFusion Admin Panel AccessEPSS 10.1%CVE-2022-1631MEDIUMUsers Account Pre-Takeover or Users Account Takeover. in microweber/microweberEPSS 8.8%CVE-2021-24215—Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege EscalationEPSS 8.5%CVE-2019-11634CRITICALCitrix Workspace App before 1904 for Windows has Incorrect Access Control.EPSS 8.1%KEVCVE-2017-12171MEDIUMA regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuratEPSS 8.1%CVE-2025-56241HIGHAztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator passwoEPSS 8.0%CVE-2018-15640HIGHImproper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated prEPSS 7.8%CVE-2022-22282—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connectionEPSS 7.8%CVE-2019-3934—Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP EPSS 7.7%CVE-2022-36923MEDIUMZoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils EPSS 7.7%CVE-2024-5655CRITICALImproper Access Control in GitLabEPSS 7.5%CVE-2024-6385CRITICALImproper Access Control in GitLabEPSS 7.2%CVE-2023-37759—Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to regiEPSS 7.0%CVE-2025-25948CRITICALIncorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS)EPSS 6.9%CVE-2017-7918—An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attackerEPSS 6.7%CVE-2021-36888CRITICALWordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromiseEPSS 6.5%CVE-2022-32212—A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that EPSS 6.4%CVE-2023-0744CRITICALImproper Access Control in answerdev/answerEPSS 6.4%CVE-2026-33484HIGHLangflow has Unauthenticated IDOR on Image DownloadsEPSS 6.1%CVE-2019-3933—Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /iEPSS 5.9%