Fallos del tipo CWE-340

61 resultados

Geração de números ou identificadores previsíveis

Quando um software gera números aleatórios, tokens, IDs de sessão ou sementes criptográficas de forma previsível ou com entropia insuficiente, um atacante consegue adivinhar ou reproduzir esses valores. Isso compromete mecanismos de segurança que dependem de imprevisibilidade, como autenticação, autorização e proteção de estado.

Ejemplo

Um sistema gera tokens de sessão baseado apenas no timestamp atual (ex: `token = hash(data_hora)`). Um atacante observa alguns tokens legítimos, identifica o padrão temporal e forja um token válido para sequestrar a sessão de outro usuário.

Cómo mitigar

Use sempre um gerador de números aleatórios criptograficamente seguro (ex: `java.security.SecureRandom`, `/dev/urandom`, `secrets` em Python) e alimentado com entropia de qualidade do sistema operacional. Nunca use `Math.random()`, `rand()` simples ou timestamps como base para tokens ou IDs sensíveis.

CVE-2026-11374CRITICALAccount Takeover via Predictable SSO Ticket GenerationEPSS 2.5%CVE-2024-47945CRITICALPredictable Session IDEPSS 0.9%CVE-2026-118527MEDIUMUse of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to uploadEPSS 0.8%KEVCVE-2025-69286HIGHRAGFlow has Predictable Token Generation Leading to Authentication Bypass VulnerabilityEPSS 0.8%CVE-2024-28957MEDIUMGeneration of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If this vulnerability is exploited, a remote uEPSS 0.8%CVE-2025-40931CRITICALApache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session idEPSS 0.6%CVE-2020-1905—Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, wEPSS 0.6%CVE-2026-13577HIGHDancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailableEPSS 0.6%CVE-2026-95653HIGHConcrete CMS Community Store before 2.7.8 Predictable Digital Download TokenEPSS 0.6%CVE-2026-3256CRITICALHTTP::Session versions before 0.54 for Perl defaults to using insecurely generated session idsEPSS 0.5%CVE-2025-15604CRITICALAmon2 versions before 6.17 for Perl use an insecure random_string implementation for security functionsEPSS 0.5%CVE-2025-10148MEDIUMpredictable WebSocket maskEPSS 0.5%CVE-2024-52299HIGHThe PDF viewer macro allows accessing any attachment without access right checksEPSS 0.5%CVE-2026-9733CRITICALMojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameterEPSS 0.5%CVE-2026-56016MEDIUMCGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sourcesEPSS 0.5%CVE-2026-2473HIGHBucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.EPSS 0.5%CVE-2025-40926CRITICALPlack::Middleware::Session::Simple versions before 0.05 for Perl generates session ids insecurelyEPSS 0.5%CVE-2024-7558HIGHJUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unpriEPSS 0.5%CVE-2025-40920HIGHCatalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl use insecurely generated noncesEPSS 0.5%CVE-2026-2439CRITICALConcierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session idsEPSS 0.5%