Fallos del tipo CWE-424

49 resultados

Proteção inadequada de caminhos alternativos

Ocorre quando uma aplicação protege um caminho ou recurso principal, mas deixa desprotegido um caminho alternativo que leva ao mesmo destino. Um atacante contorna as defesas usando uma rota diferente (URL alternativa, extensão de arquivo não validada, diretório espelho) para acessar o que deveria estar bloqueado.

Ejemplo

Um site bloqueia acesso a /admin/painel, mas não protege /admin%2520/painel (URL codificada), ou permite acesso via /Admin/painel (variação de case), ou ainda deixa exposto /backup/admin.php que é cópia do arquivo protegido. O atacante usa qualquer um desses caminhos para burlar as defesas.

Cómo mitigar

Aplique validação e proteção em TODOS os caminhos equivalentes: normalize URLs antes de validar (resolve .., %xx, case), aplique regras de controle de acesso no nível mais profundo possível (núcleo da aplicação, não só no firewall/WAF), e teste sistematicamente variações (codificação, case, extensões, diretórios-espelho).

CVE-2024-58136CRITICALYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iEPSS 87.8%KEVCVE-2025-48827CRITICALvBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningEPSS 75.6%CVE-2025-48828CRITICALCertain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By cEPSS 57.3%CVE-2019-18997MEDIUMPB610 HMISimulator provides interface with access to arbitrary filesEPSS 1.5%CVE-2023-20272MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplEPSS 0.9%CVE-2026-66756MEDIUMApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseEPSS 0.7%CVE-2021-3793MEDIUMAn improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated EPSS 0.7%CVE-2026-82754MEDIUMash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsEPSS 0.7%CVE-2026-114659HIGHGrav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesEPSS 0.6%CVE-2024-8311MEDIUMImproper Protection of Alternate Path in GitLabEPSS 0.6%CVE-2026-4913MEDIUMImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenEPSS 0.6%CVE-2026-82586HIGHAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesEPSS 0.5%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.5%CVE-2026-86145HIGHPCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching worksEPSS 0.4%CVE-2024-3927MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassEPSS 0.4%CVE-2019-18996HIGHABB PB610 HMIStudio accepts malicious DLL file in an applicationEPSS 0.4%CVE-2026-76529CRITICALImproper Protection of Alternate Path in Splunk SOAREPSS 0.4%CVE-2026-69979MEDIUMWindows AppX Deployment Service Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-89039MEDIUMArbitrary file read via the convert_playwright_script prompt in mcp-k6EPSS 0.4%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%