Falhas do tipo CWE-283

23 resultados

Propriedade não verificada

A aplicação assume que um recurso, arquivo ou objeto pertence a um usuário sem validar efetivamente essa propriedade. Um atacante pode acessar, modificar ou deletar recursos de outros usuários porque o código não confirma se quem está fazendo a requisição é realmente o proprietário.

Exemplo

Um sistema de documentos permite deletar arquivo via GET /delete?file_id=123, mas não valida se o usuário logado é o criador do arquivo. Um atacante consegue descobrir IDs de documentos de outros usuários e deletá-los acessando a URL diretamente.

Como mitigar

Sempre validar propriedade antes de qualquer operação: verificar se user_id do recurso coincide com user_id da sessão autenticada. Usar IDs opacos (UUIDs) para documentos em vez de sequenciais, e nunca confiar em parâmetros do cliente para confirmar permissão.

CVE-2020-8554MEDIUMKubernetes man in the middle using LoadBalancer or ExternalIPsEPSS 9.3%CVE-2024-27903HIGHOpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitraryEPSS 8.9%CVE-2021-24501—Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsEPSS 1.3%CVE-2021-24500—Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesEPSS 0.6%CVE-2025-1007MEDIUMImproper Authorization in /user/namespace/{namespace}/detailsEPSS 0.5%CVE-2022-29220MEDIUMNo verification of commits origin in github-action-merge-dependabotEPSS 0.5%CVE-2023-30544LOWKiwi TCMS may allow user to update email address to unverified oneEPSS 0.4%CVE-2026-20912CRITICALGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureEPSS 0.4%CVE-2025-47940HIGHTYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerEPSS 0.4%CVE-2026-44707MEDIUMChatwoot: Pre-Account Takeover via OAuth on Unconfirmed AccountsEPSS 0.3%CVE-2023-6068LOWOn affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and someEPSS 0.3%CVE-2025-36091MEDIUMIBM Business Automation Insights unverified ownershipEPSS 0.3%CVE-2026-26016CRITICALPterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing AuthorizationEPSS 0.3%CVE-2026-27486MEDIUMOpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process CleanupEPSS 0.3%CVE-2025-12815MEDIUMAn ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.EPSS 0.3%CVE-2026-44562MEDIUMOpen WebUI: Model Import Overwrites Any Model Without Ownership CheckEPSS 0.3%CVE-2026-29788HIGHTSPortal: Anyone can forge self-deletion requests of any userEPSS 0.3%CVE-2026-4269MEDIUMImproper S3 ownership verification in Bedrock AgentCore Starter ToolkitEPSS 0.2%CVE-2025-9822MEDIUMSecret data extraction via elfinderEPSS 0.2%CVE-2026-0598MEDIUMAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiEPSS 0.2%