Fallos del tipo CWE-424

39 resultados

Proteção inadequada de caminhos alternativos

Ocorre quando uma aplicação protege um caminho ou recurso principal, mas deixa desprotegido um caminho alternativo que leva ao mesmo destino. Um atacante contorna as defesas usando uma rota diferente (URL alternativa, extensão de arquivo não validada, diretório espelho) para acessar o que deveria estar bloqueado.

Ejemplo

Um site bloqueia acesso a /admin/painel, mas não protege /admin%2520/painel (URL codificada), ou permite acesso via /Admin/painel (variação de case), ou ainda deixa exposto /backup/admin.php que é cópia do arquivo protegido. O atacante usa qualquer um desses caminhos para burlar as defesas.

Cómo mitigar

Aplique validação e proteção em TODOS os caminhos equivalentes: normalize URLs antes de validar (resolve .., %xx, case), aplique regras de controle de acesso no nível mais profundo possível (núcleo da aplicação, não só no firewall/WAF), e teste sistematicamente variações (codificação, case, extensões, diretórios-espelho).

CVE-2024-58136CRITICALYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iEPSS 87.8%KEVCVE-2025-48827CRITICALvBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningEPSS 75.8%CVE-2025-48828CRITICALCertain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By cEPSS 57.6%CVE-2019-18997MEDIUMPB610 HMISimulator provides interface with access to arbitrary filesEPSS 1.5%CVE-2023-20272MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplEPSS 0.9%CVE-2021-3793MEDIUMAn improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated EPSS 0.7%CVE-2024-8311MEDIUMImproper Protection of Alternate Path in GitLabEPSS 0.6%CVE-2026-4913MEDIUMImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenEPSS 0.6%CVE-2026-66756MEDIUMApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseEPSS 0.4%CVE-2024-3927MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassEPSS 0.4%CVE-2019-18996HIGHABB PB610 HMIStudio accepts malicious DLL file in an applicationEPSS 0.4%CVE-2026-82754MEDIUMash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsEPSS 0.4%CVE-2026-86145HIGHPCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching worksEPSS 0.4%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.3%CVE-2026-82586HIGHAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesEPSS 0.3%CVE-2026-54423HIGHIn OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use tEPSS 0.3%CVE-2025-58079MEDIUMImproper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create maliciousEPSS 0.3%CVE-2022-1742MEDIUM2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424EPSS 0.3%CVE-2024-3460HIGHIn KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing EPSS 0.3%