Fallos del tipo CWE-287

2806 resultados

Autenticação inadequada ou ausente

A aplicação não valida ou valida de forma insuficiente a identidade de quem tenta acessá-la. Quando um usuário diz ser quem é, o sistema acredita sem verificar corretamente, permitindo que atacantes se façam passar por outros usuários ou contas legítimas.

Ejemplo

Um sistema que aceita login apenas com nome de usuário, sem senha. Ou uma API que confia no header 'User-ID' enviado pelo cliente sem validar se aquele usuário realmente existe ou tem sessão ativa. Um atacante simplesmente altera o header e acessa dados de outra conta.

Cómo mitigar

Implemente autenticação robusta: exija múltiplos fatores (senha forte + MFA), valide credenciais contra base de dados segura, use sessões com token assinado e com expiração, nunca confie em dados enviados pelo cliente como prova de identidade. Revise regularmente logs de acesso para detectar abusos.

CVE-2021-34578CRITICALWAGO: Authentication Vulnerability in Web-Based ManagementEPSS 1.0%CVE-2023-25264HIGHAn issue was discovered in Docmosis Tornado prior to version 2.9.5. An unauthenticated attacker can bypass the authentication check filter cEPSS 1.0%CVE-2022-1084HIGHSourceCodester One Church Management System Session userregister.php improper authenticationEPSS 1.0%CVE-2024-5044MEDIUMEmlog Pro Cookie improper authenticationEPSS 1.0%CVE-2022-34155HIGHWordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken AuthenticationEPSS 1.0%CVE-2023-28862CRITICALAn issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling dEPSS 1.0%CVE-2022-39289CRITICALDatabase log access in ZoneMinderEPSS 1.0%CVE-2022-4002HIGHA command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted APIEPSS 1.0%CVE-2022-35135HIGHBoodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.EPSS 1.0%CVE-2021-26077CRITICALBroken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian CEPSS 1.0%CVE-2021-32951MEDIUMAdvantech WebAccess/NMS Improper AuthenticationEPSS 0.9%CVE-2021-26073HIGHBroken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js pacEPSS 0.9%CVE-2020-26236HIGHVerification Code Hijacking in ScratchVerifierEPSS 0.9%CVE-2023-31127CRITICALDMTF-2023-0001: SPDM mutual authentication bypassEPSS 0.9%CVE-2018-7340HIGHMultiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversalEPSS 0.9%CVE-2026-62827HIGHMicrosoft SharePoint Server Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2022-2533MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2EPSS 0.9%CVE-2025-2339MEDIUMotale Tale Blog logs improper authenticationEPSS 0.9%CVE-2020-11101CRITICALSierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login sessiEPSS 0.9%CVE-2023-6344MEDIUMTyler Technologies Court Case Management Plus use of Aquaforest TIFF Server te003.aspx and te004.aspx allows authentication bypassEPSS 0.9%