Falhas do tipo CWE-284

7.106 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2023-28845LOWChat room membership disclosed via autocompletion in Nextcloud talkEPSS 0.4%CVE-2024-1370MEDIUMMaintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information ExposureEPSS 0.4%CVE-2023-27268MEDIUMImproper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)EPSS 0.4%CVE-2023-39376MEDIUMSiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the networkEPSS 0.4%CVE-2026-82809MEDIUMvidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosureEPSS 0.4%CVE-2024-41600HIGHInsecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via theEPSS 0.4%CVE-2026-5960MEDIUMcode-projects Patient Record Management System SQL Database Backup File hcpms.sql information disclosureEPSS 0.4%CVE-2019-10128—A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not locEPSS 0.4%CVE-2026-6000MEDIUMcode-projects Online Library Management System SQL Database Backup File library.sql information disclosureEPSS 0.4%CVE-2026-5847MEDIUMcode-projects Movie Ticketing System SQL Database Backup File moviedb.sql information disclosureEPSS 0.4%CVE-2025-3566MEDIUMveal98 小牛肉 Echo 开源社区系统 uploadMdPic unrestricted uploadEPSS 0.4%CVE-2023-34404MEDIUMMercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins and get access to intEPSS 0.4%CVE-2026-3209MEDIUMfosrl Pangolin Role verifyApiKeyRoleAccess access controlEPSS 0.4%CVE-2026-70952HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%CVE-2025-51529MEDIUMIncorrect Access Control in the AJAX endpoint functionality in jonkastonka Cookies and Content Security Policy plugin through version 2.29 aEPSS 0.4%CVE-2026-61302HIGHVulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). Supported versionsEPSS 0.4%CVE-2026-71024HIGHVulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). TheEPSS 0.4%CVE-2024-0972MEDIUMBuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST APIEPSS 0.4%CVE-2023-49961HIGHWALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data eEPSS 0.4%CVE-2023-6202MEDIUMInsecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost BoardsEPSS 0.4%