Fallos del tipo CWE-295

852 resultados

Validação inadequada de certificados SSL/TLS

A aplicação não valida corretamente o certificado SSL/TLS do servidor remoto, aceitando certificados inválidos, expirados ou de domínios diferentes. Isso permite ataques man-in-the-middle onde um atacante intercepta a comunicação mesmo com criptografia, comprometendo a confidencialidade e integridade dos dados.

Ejemplo

Uma API cliente ignora erros de validação de certificado (ex: desabilita verificação de hostname ou ignora exceções de certificado inválido) e faz requisições HTTPS para servidores externos. Um atacante na rede intercepta o tráfego, apresenta seu próprio certificado, e consegue ler dados sensíveis como tokens de autenticação ou credenciais.

Cómo mitigar

Sempre validar certificados: verificar hostname, data de validade e cadeia de confiança. Usar bibliotecas padrão do seu runtime (HttpClient do .NET, requests do Python, etc.) com validação ativada por padrão. Nunca desabilitar validação SSL/TLS em produção; se precisar em desenvolvimento, use variáveis de ambiente e revise criticamente o código antes de deploy.

CVE-2023-39441—Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationEPSS 0.8%CVE-2022-32156HIGHSplunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validationEPSS 0.8%CVE-2024-56521CRITICALAn issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.EPSS 0.8%CVE-2022-31183CRITICALmTLS client verification is skipped in fs2 on Node.jsEPSS 0.8%CVE-2022-31105HIGHArgo CD's certificate verification is skipped for connections to OIDC providersEPSS 0.8%CVE-2022-32151HIGHSplunk Enterprise disabled TLS validation using the CA certificate stores in Python 3 libraries by defaultEPSS 0.8%CVE-2025-68121CRITICALUnexpected session resumption in crypto/tlsEPSS 0.8%CVE-2023-35142HIGHJenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default.EPSS 0.8%CVE-2021-1134HIGHCisco DNA Center Certificate Validation VulnerabilityEPSS 0.8%CVE-2026-3336HIGHPKCS7_verify Certificate Chain Validation Bypass in AWS-LCEPSS 0.8%CVE-2025-48802MEDIUMWindows SMB Server Spoofing VulnerabilityEPSS 0.8%CVE-2026-21228HIGHAzure Local Remote Code Execution VulnerabilityEPSS 0.8%CVE-2011-0199MEDIUMThe Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificatEPSS 0.8%CVE-2019-5102MEDIUMAn exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting toEPSS 0.8%CVE-2019-5101MEDIUMAn exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting toEPSS 0.8%CVE-2018-5408—PrinterLogic Print Management Software fails to validate the management portal SSL certificatesEPSS 0.7%CVE-2022-33684HIGHApache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate ValidationEPSS 0.7%CVE-2020-7924MEDIUMSpecific command line parameter might result in accepting invalid certificateEPSS 0.7%CVE-2025-14819MEDIUMOpenSSL partial chain store policy bypassEPSS 0.7%CVE-2024-52510MEDIUMNextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is emptyEPSS 0.7%