Fallos del tipo CWE-290

717 resultados

Autenticação inadequada sujeita a falsificação de identidade

Ocorre quando o mecanismo de autenticação é implementado de forma fraca ou incompleta, permitindo que um atacante se faça passar por outro usuário ou sistema sem precisar das credenciais legítimas. O risco é grave: qualquer um pode ganhar acesso não autorizado simplesmente contornando ou falsificando a identidade.

Ejemplo

Um app que autentica usuários apenas verificando um header HTTP customizado (tipo 'X-User-ID: 123') sem validação criptográfica real. Um atacante muda esse header para 'X-User-ID: admin' e consegue acesso à conta administrativa. Ou um serviço que aceita requisições apenas porque vêm de um IP específico, sem verificar certificados ou assinaturas.

Cómo mitigar

Use protocolos de autenticação estabelecidos (OAuth 2.0, JWT com assinatura, SAML) em vez de inventar o seu. Sempre valide credenciais no servidor com mecanismos criptográficos (hash, assinatura digital, certificados). Nunca confie em headers HTTP, IPs ou tokens não assinados como prova única de identidade.

CVE-2023-20245MEDIUMMultiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefEPSS 0.6%CVE-2022-38712MEDIUM"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofinEPSS 0.6%CVE-2023-41133MEDIUMWordPress Secure Admin IP plugin <= 2.0 - IP Spoofing vulnerabilityEPSS 0.6%CVE-2023-36883MEDIUMMicrosoft Edge for iOS Spoofing VulnerabilityEPSS 0.6%CVE-2024-22519HIGHAn issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.EPSS 0.6%CVE-2026-70179HIGHASP.NET Core Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-34053MEDIUMAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path ManipulationEPSS 0.6%CVE-2023-41329LOWDomain restrictions bypass via DNS Rebinding in WireMock and WireMock StudioEPSS 0.6%CVE-2026-42354CRITICALSentry: Improper authentication on SAML SSO process allows user identity linkingEPSS 0.6%CVE-2022-31738MEDIUMWhen exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user cEPSS 0.6%CVE-2026-50755CRITICALAn issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header valueEPSS 0.6%CVE-2019-3884LOWA vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from anothEPSS 0.6%CVE-2026-55652CRITICALWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)EPSS 0.6%CVE-2025-27671CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0EPSS 0.6%CVE-2023-2807MEDIUMAuthentication bypass in password reset processEPSS 0.6%CVE-2023-23398HIGHMicrosoft Excel Spoofing VulnerabilityEPSS 0.6%CVE-2025-34065MEDIUMAVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL PathEPSS 0.6%CVE-2026-49757CRITICALOAuth2/OIDC account takeover in AshAuthentication via email-based user matchingEPSS 0.6%CVE-2022-51026CRITICALBytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted LoginEPSS 0.6%CVE-2026-76356HIGHAuthentication Bypass through IP Address Spoofing in the Automation Broker in Splunk SOAREPSS 0.6%