Fallos del tipo CWE-348

104 resultados

Uso de fonte menos confiável

A aplicação toma decisões de segurança baseando-se em dados que vêm de uma fonte menos confiável (como entrada do usuário, cabeçalhos HTTP, variáveis de ambiente) quando deveria usar uma fonte de maior confiança (como base de dados interna, configuração do servidor, atributos validados). Isso permite que um atacante manipule o fluxo lógico forjando ou alterando esses dados.

Ejemplo

Um sistema de permissões que lê o nível de privilégio do usuário de um cookie ou cabeçalho HTTP em vez de consultá-lo no banco de dados do servidor. Um atacante modifica o cookie para 'admin' e ganha acesso a funcionalidades restritas.

Cómo mitigar

Sempre valide e recupere dados sensíveis de segurança (identidade, permissões, estado de autenticação) a partir de fontes confiáveis controladas pelo servidor (sessão autenticada, banco de dados). Nunca confie em dados fornecidos pelo cliente ou derivados de entrada do usuário para decisões críticas de autorização.

CVE-2026-44183CRITICALCleanuparr: X-Forwarded-For leftmost parsing allows remote unauthenticated admin takeover when reverse-proxy mode is enabledEPSS 0.2%CVE-2026-86041MEDIUMezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` headerEPSS 0.2%CVE-2026-119711MEDIUMPipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For HeaderEPSS 0.2%CVE-2026-77463MEDIUMRemark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deploymentEPSS 0.2%CVE-2022-4533MEDIUMLimit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism BypassEPSS 0.2%CVE-2026-16272CRITICALClient IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS ModuleEPSS 0.2%CVE-2022-4532MEDIUMLOGIN AND REGISTRATION ATTEMPTS LIMIT<= 2.1 - IP Address Spoofing to Protection Mechanism BypassEPSS 0.2%CVE-2026-108736MEDIUMSpeedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For SpoofingEPSS 0.2%CVE-2026-62987MEDIUMFabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection headerEPSS 0.2%CVE-2026-110726MEDIUMIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.2%CVE-2026-101277MEDIUMTrusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted sourceEPSS 0.2%CVE-2025-27913LOWPassbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), canEPSS 0.2%CVE-2020-37248MEDIUMOfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle aEPSS 0.2%CVE-2026-108162MEDIUMPingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-ForEPSS 0.2%CVE-2025-24856MEDIUMAn issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows aEPSS 0.2%CVE-2026-103592MEDIUMsimple-php-router through 5.4.1.7 IP restriction bypass via forwarding headersEPSS 0.2%CVE-2026-59897MEDIUMHono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationEPSS 0.2%CVE-2026-61589MEDIUMdjust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live pathEPSS 0.2%CVE-2026-33690MEDIUMAVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()EPSS 0.2%CVE-2026-54289MEDIUMHono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restEPSS 0.2%