Falhas do tipo CWE-264

309 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2022-38134MEDIUMWordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Authenticated Broken Access Control vulnerabilityEPSS 1.0%CVE-2022-23708—A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built proEPSS 1.0%CVE-2022-36387HIGHWordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerabilityEPSS 1.0%CVE-2018-0089—A vulnerability in the Policy and Charging Rules Function (PCRF) of the Cisco Policy Suite (CPS) could allow an unauthenticated, remote attaEPSS 1.0%CVE-2022-38070MEDIUMWordPress Pop-up plugin <= 1.1.5 - Privilege Escalation vulnerabilityEPSS 1.0%CVE-2019-3475HIGHLocal privilege escalation in Filr famtdEPSS 1.0%CVE-2019-1980MEDIUMCisco Firepower Threat Defense Software Nonstandard Protocol Detection Bypass VulnerabilityEPSS 1.0%CVE-2019-1982MEDIUMCisco Firepower Threat Defense Software HTTP Filtering Bypass VulnerabilityEPSS 1.0%CVE-2022-37344HIGHWordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerabilityEPSS 0.9%CVE-2022-36425MEDIUMWordPress Beaver Builder plugin <= 2.5.4.3 - Broken Access Control vulnerabilityEPSS 0.9%CVE-2022-36793MEDIUMWordPress WP Shop plugin <= 3.9.6 - Unauthenticated Plugin Settings Change & Data Deletion vulnerabilitiesEPSS 0.9%CVE-2019-16017MEDIUMCisco Unified Customer Voice Portal Insecure Direct Object Reference VulnerabilityEPSS 0.9%CVE-2022-36427HIGHWordPress About Rentals plugin <= 1.5 - Missing Access Control vulnerabilityEPSS 0.9%CVE-2022-25649MEDIUMWordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Multiple Improper Access Control vulnerabilitiesEPSS 0.9%CVE-2022-27235MEDIUMWordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilitiesEPSS 0.9%CVE-2022-42459HIGHWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerabilityEPSS 0.9%CVE-2019-1594HIGHCisco NX-OS Software 802.1X Extensible Authentication Protocol over LAN Denial of Service VulnerabilityEPSS 0.8%CVE-2020-36528MEDIUMPlatinum Mobile MobileHandler.ashx access controlEPSS 0.8%CVE-2021-28052HIGHHitachi Content Platform Information Disclosure VulnerabilityEPSS 0.8%CVE-2022-45069MEDIUMWordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerabilityEPSS 0.8%