Fallos del tipo CWE-341

20 resultados

Estado observável previsível

Ocorre quando o sistema gera valores que deveriam ser imprevisíveis (como tokens, IDs de sessão, nonces) usando apenas informações que um atacante pode observar ou deduzir do estado do sistema (como timestamp, contador sequencial ou dados públicos). Um adversário consegue prever o próximo valor e contornar mecanismos de segurança que dependem dessa imprevisibilidade.

Ejemplo

Um site gera IDs de sessão concatenando timestamp + número do usuário (ex: '1699564800_42'). Um atacante observa dois tokens, vê o padrão de incremento no tempo, e consegue forjar um ID válido para outra sessão sem conhecer a senha. Ou um sistema de reset de senha usa um token baseado apenas no ID do usuário + data, permitindo que o atacante calcule tokens válidos para qualquer conta.

Cómo mitigar

Use uma fonte de aleatoriedade criptograficamente segura (como `secrets` em Python, `java.security.SecureRandom` em Java, ou `/dev/urandom` em C) para gerar tokens e IDs sensíveis. Nunca confie em sequências previsíveis ou dados observáveis do sistema. Valide e expire rapidamente esses valores no servidor.

CVE-2019-6563—Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, whEPSS 1.7%CVE-2020-1731CRITICALA flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random adminEPSS 1.3%CVE-2018-17917—All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potentiEPSS 1.3%CVE-2020-5365MEDIUMDell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundEPSS 1.0%CVE-2024-10141MEDIUMjsbroks COCO Annotator Session predictable stateEPSS 0.8%CVE-2026-38968CRITICALntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPEPSS 0.6%CVE-2025-40780HIGHCache poisoning due to weak PRNGEPSS 0.5%CVE-2025-48461MEDIUMWeak Session Cookie EntropyEPSS 0.5%CVE-2021-4277LOWfredsmith utils Filename screenshot_sync predictable stateEPSS 0.5%CVE-2026-19565LOWApache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKeyEPSS 0.4%CVE-2026-40164HIGHjq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedEPSS 0.4%CVE-2026-42365HIGHGeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerabilityEPSS 0.3%CVE-2026-15571HIGHKeycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc clientEPSS 0.3%CVE-2023-49259HIGHBruteforcing authentication cookie for a given userEPSS 0.3%CVE-2026-5081CRITICALApache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecureEPSS 0.3%CVE-2026-87913MEDIUMMissing S3 bucket ownership verification in the AWS Security Agent MCP serverEPSS 0.2%CVE-2026-87912MEDIUMMissing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecopsEPSS 0.2%CVE-2025-42925MEDIUMPredictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)EPSS 0.2%CVE-2026-36609HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests froEPSS 0.2%CVE-2026-94456CRITICALUnauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysEPSS —