Fallos del tipo CWE-306

3091 resultados

Ausência de autenticação em funcionalidade crítica

A aplicação permite acesso a operações que exigem identidade verificada ou consomem recursos significativos sem validar quem está fazendo a requisição. Isso permite que qualquer pessoa, autenticada ou não, execute ações sensíveis — desde consumir quotas até acessar dados ou disparar processos custosos.

Ejemplo

Um serviço de relatórios expõe um endpoint `/gerar-relatorio` que processa grandes volumes de dados sem verificar credenciais. Um atacante chama o endpoint repetidas vezes, sobrecarregando a infraestrutura e causando negação de serviço, enquanto qualquer usuário consegue disparar operações com alto custo computacional.

Cómo mitigar

Implemente validação de autenticação (tokens JWT, OAuth, sessões) antes de executar qualquer operação sensível ou de alto custo. Combine com rate limiting e quotas por usuário para restringir abuso mesmo após autenticação.

CVE-2014-125124CRITICALPandora FMS <= 5.0RC1 Anyterm Unauthenticated Command InjectionEPSS 2.4%CVE-2021-39233—Container-related datanode operations can be called without authorizationEPSS 2.4%CVE-2019-3917—The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on thEPSS 2.4%CVE-2026-116485CRITICALdanmu_api before 1.21.7 Authentication Bypass via Default Token in Env EndpointsEPSS 2.3%CVE-2024-37152MEDIUMUnauthenticated Access to sensitive settings in Argo CDEPSS 2.3%CVE-2025-34089CRITICALRemote for Mac Unauthenticated Remote Code Execution via AppleScript InjectionEPSS 2.3%CVE-2017-12733—A Missing Authentication for Critical Function issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel InEPSS 2.3%CVE-2020-12017—GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web appEPSS 2.3%CVE-2021-1393CRITICALCisco Application Services Engine Unauthorized Access VulnerabilitiesEPSS 2.3%CVE-2020-7540—A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon QuantuEPSS 2.3%CVE-2026-90898CRITICALBifrost unauthenticated remote code execution via MCP stdio client registrationEPSS 2.3%CVE-2019-1895CRITICALCisco Enterprise NFV Infrastructure Software VNC Authentication Bypass VulnerabilityEPSS 2.3%CVE-2026-2624CRITICALAuthentication Bypass in ePati's Antikor NGFWEPSS 2.3%CVE-2019-1631MEDIUMCisco Integrated Management Controller Information Disclosure VulnerabilityEPSS 2.2%CVE-2026-75128CRITICALLangchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call EndpointEPSS 2.2%CVE-2020-6769CRITICALMissing Authentication for Critical Function in Bosch Video Streaming GatewayEPSS 2.2%CVE-2022-39412HIGHVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affEPSS 2.2%CVE-2020-3531CRITICALCisco IoT Field Network Director Unauthenticated REST API VulnerabilityEPSS 2.2%CVE-2026-75825HIGHAuthentication Bypass vulnerabilityEPSS 2.2%CVE-2018-4853—A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to porEPSS 2.2%