Fallos del tipo CWE-441

159 resultados

Intermediário não intencional ('Deputado confuso')

Ocorre quando um componente com privilégios é induzido a executar ações em nome de um atacante, sem validar adequadamente se a solicitação veio realmente de quem deveria autorizar. O código confia em identificadores fracos ou contexto incompleto, permitindo que um terceiro abuse da autoridade do componente para acessar recursos ou realizar operações que não conseguiria fazer diretamente.

Ejemplo

Um serviço web interno que processa solicitações de eliminação de arquivos verifica se o usuário está autenticado, mas não valida se a solicitação veio do próprio usuário ou de um terceiro (ex: injeção de referência cruzada ou CSRF). Um atacante induz o navegador da vítima a fazer um pedido de deleção usando os cookies da vítima, e o serviço executa a ação porque reconhece a autenticação, não a origem legítima.

Cómo mitigar

Implemente validação robusta da origem e integridade da solicitação: use tokens CSRF únicos e vinculados à sessão, valide o header Referer/Origin, e aplique autenticação step-up para operações sensíveis. Nunca confie apenas em cookies ou sessão para operações de risco; exija confirmação explícita do usuário ou re-autenticação.

CVE-2026-58739MEDIUMIn platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy. This could lead to locEPSS 0.1%CVE-2026-56879MEDIUMIn gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of pEPSS 0.1%CVE-2026-58698MEDIUMIn ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy. This could lead to local escalEPSS 0.1%CVE-2026-56992MEDIUMIn multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with SysEPSS 0.1%CVE-2025-36889MEDIUMIn onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local informatioEPSS 0.1%CVE-2026-0183MEDIUMIn CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System exeEPSS 0.1%CVE-2026-28644HIGHIn startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could EPSS 0.1%CVE-2026-0098HIGHIn getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could EPSS 0.1%CVE-2026-28614HIGHIn onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalaEPSS 0.1%CVE-2026-45519LOWIn screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This coEPSS 0.1%CVE-2026-28636HIGHIn setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.EPSS 0.1%CVE-2026-28607HIGHIn multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could leadEPSS 0.1%CVE-2026-28616HIGHIn Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalatEPSS 0.1%CVE-2026-56945HIGHIn VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additionaEPSS 0.1%CVE-2026-28624HIGHIn multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could leEPSS 0.1%CVE-2026-28603HIGHIn assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confusedEPSS 0.1%CVE-2026-28600HIGHIn onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead toEPSS 0.1%CVE-2026-77255HIGHMCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issueEPSS —CVE-2026-77246HIGHMCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload PathEPSS —