Fallos del tipo CWE-295

853 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2024-13956HIGHSSL Verification BypassEPSS 0.4%CVE-2023-25392MEDIUMAllegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.EPSS 0.4%CVE-2021-20328MEDIUMMongoDB Java driver client-side field level encryption not verifying KMS host nameEPSS 0.4%CVE-2026-59818MEDIUMetcd: gRPC client listener does not enforce `--client-crl-file` certificate revocationEPSS 0.4%CVE-2022-41316MEDIUMHashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role'sEPSS 0.4%CVE-2026-8763CRITICALName Constraints bypass via trailing dot in rfc822Name and URIEPSS 0.4%CVE-2024-5261CRITICALTLS certificate are not properly verified when utilizing LibreOfficeKitEPSS 0.4%CVE-2023-1664MEDIUMA flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverseEPSS 0.4%CVE-2026-82208HIGHwolfSSL CA-cache hit overrides callbackEPSS 0.4%CVE-2022-34865MEDIUMTraffic intelligence feeds vulnerability CVE-2022-34865EPSS 0.4%CVE-2025-29331CRITICALAn issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passeEPSS 0.4%CVE-2026-42013HIGHGnutls: gnutls: certificate validation bypass due to oversized subject alternative nameEPSS 0.4%CVE-2024-22030HIGHRancher agents can be hijacked by taking over the Rancher Server URLEPSS 0.4%CVE-2017-3190—Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificaEPSS 0.4%CVE-2022-38666HIGHJenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validEPSS 0.4%CVE-2020-36659HIGHIn Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backEPSS 0.4%CVE-2026-55215HIGHMariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`EPSS 0.4%CVE-2022-45391HIGHJenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hEPSS 0.4%CVE-2026-2590CRITICALImproper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop ManaEPSS 0.4%CVE-2023-49247—Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.4%