Falhas do tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2018-0463—Cisco Network Services Orchestrator Network Plug and Play Information Disclosure VulnerabilityEPSS 1.5%CVE-2017-7916—A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFEPSS 1.5%CVE-2020-3112HIGHCisco Data Center Network Manager Privilege Escalation VulnerabilityEPSS 1.5%CVE-2017-6624—A vulnerability in Cisco IOS 15.5(3)M Software for Cisco CallManager Express (CME) could allow an unauthenticated, remote attacker to make uEPSS 1.4%CVE-2019-1969MEDIUMCisco NX-OS Software SNMP Access Control List Configuration Name Bypass VulnerabilityEPSS 1.4%CVE-2018-0096—A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attEPSS 1.4%CVE-2019-17326—ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET request with a speciaEPSS 1.3%CVE-2019-19106CRITICALABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issuesEPSS 1.3%CVE-2019-15272MEDIUMCisco Unified Communications Manager Security Bypass VulnerabilityEPSS 1.3%CVE-2022-34149CRITICALWordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerabilityEPSS 1.3%CVE-2019-1906MEDIUMCisco Prime Infrastructure Virtual Domain Privilege Escalation VulnerabilityEPSS 1.3%CVE-2022-36375HIGHWordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2022-33969HIGHWordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerabilityEPSS 1.3%CVE-2019-17322—ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set to the file path to EPSS 1.2%CVE-2022-33970HIGHWordPress Shortcode Addons plugin <= 3.1.2 - Authenticated WordPress Options Change vulnerabilityEPSS 1.2%CVE-2019-15960MEDIUMCisco Webex Network Recording Admin Page Privilege Escalation VulnerabilityEPSS 1.1%CVE-2022-34868HIGHWordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerabilityEPSS 1.1%CVE-2022-29423LOWWordPress Countdown & Clock plugin <= 2.3.2 - Pro Features Lock Bypass vulnerabilityEPSS 1.1%CVE-2019-1981MEDIUMCisco Firepower Threat Defense Software NULL Character Obfuscation Detection Bypass VulnerabilityEPSS 1.0%CVE-2022-38134MEDIUMWordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerabilityEPSS 1.0%