Falhas do tipo CWE-264

299 resultados

Controle de acesso e privilégios inadequado

Fraqueza ampla onde o software falha em implementar ou enforçar corretamente controles de acesso, permitindo que usuários acessem recursos, funções ou dados além do que deveriam. O erro está em não validar permissões adequadamente, deixando expostos dados sensíveis ou permitindo que usuários executem ações administrativas sem autorização.

Exemplo

Um endpoint de API que lista dados de outros usuários sem verificar se quem requisita tem permissão; um painel administrativo acessível diretamente via URL sem validação de role; um arquivo de backup com permissões world-readable no servidor.

Como mitigar

Implemente validação de permissões em toda operação sensível (whitelist explícita, não blacklist); use modelos de controle como RBAC ou ABAC; aplique o princípio do menor privilégio; audite regularmente as permissões de arquivos, APIs e diretórios do sistema.

CVE-2023-3599MEDIUMSourceCodester Best Fee Management System Add User admin_class.php save_user access controlEPSS 0.7%CVE-2023-20190MEDIUMA vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remoteEPSS 0.7%CVE-2019-14879MEDIUMA vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment waEPSS 0.7%CVE-2022-41781MEDIUMWordPress Permalink Manager Lite plugin <= 2.2.20 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2022-35238MEDIUMWordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerabilityEPSS 0.7%CVE-2021-28052HIGHHitachi Content Platform Information Disclosure VulnerabilityEPSS 0.7%CVE-2022-42461MEDIUMWordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerabilityEPSS 0.7%CVE-2022-45066MEDIUMWordPress WooSwipe WooCommerce Gallery plugin <= 2.0.1 - Auth. Broken Access Control vulnerabilityEPSS 0.7%CVE-2022-36246CRITICALShop Beat Services Vulnerable To Insecure PermissionsEPSS 0.7%CVE-2020-3485MEDIUMCisco Vision Dynamic Signage Director Role-Based Access Control VulnerabilityEPSS 0.7%CVE-2022-35242MEDIUMWordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerabilityEPSS 0.7%CVE-2021-21437LOWConfig Items are shown to users without permissionEPSS 0.7%CVE-2023-22633HIGHAn improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and beEPSS 0.7%CVE-2022-38067MEDIUMWordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerabilityEPSS 0.6%CVE-2019-6195MEDIUMAn authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid EPSS 0.6%CVE-2022-38135MEDIUMWordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2021-21438LOWFAQ articles are shown to users without permissionEPSS 0.6%CVE-2022-23731—V8 javascript engine (heap vulnerability) can cause privilege escalation ,which can impact on some webOS TV models.EPSS 0.6%CVE-2022-38058MEDIUMWordPress WP Shamsi plugin <= 4.1.1 - Authenticated Plugin Setting change vulnerabilityEPSS 0.6%CVE-2022-1548LOWPlaybook members are allowed to escalate their membership privileges and perform actions restricted to playbook admins.EPSS 0.6%