Falhas do tipo CWE-284

7.073 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2020-3186MEDIUMCisco Firepower Threat Defense Software Management Access List Bypass VulnerabilityEPSS 1.4%CVE-2019-7476—A vulnerability in SonicWall Global Management System (GMS), allow a remote user to gain access to the appliance using existing SSH key. ThiEPSS 1.4%CVE-2022-27805CRITICALAn authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X anEPSS 1.4%CVE-2025-32714HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2018-17953HIGHpam_access does not handle netmask matches correctlyEPSS 1.3%CVE-2021-38457CRITICALAUVESY VersiondogEPSS 1.3%CVE-2018-19634—CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.EPSS 1.3%CVE-2022-25755—A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE XEPSS 1.3%CVE-2020-3564MEDIUMCisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass VulnerabilityEPSS 1.3%CVE-2026-42569CRITICALphpvms: /importer authorization bypass causing full database wipeEPSS 1.3%CVE-2026-5311MEDIUMD-Link DNS-1550-04 file_center.cgi Webdav_Access_List access controlEPSS 1.3%CVE-2019-5644CRITICALC4G BLIS Improper Access ControlEPSS 1.3%CVE-2020-25629—A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain accessEPSS 1.3%CVE-2019-5617CRITICALC4G BLIS Improper Access ControlEPSS 1.3%CVE-2017-2664MEDIUMCloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portEPSS 1.3%CVE-2020-7547—A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see securityEPSS 1.3%CVE-2022-1025—All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentEPSS 1.3%CVE-2023-45744HIGHA data integrity vulnerability exists in the web interface /cgi-bin/upload_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU)EPSS 1.3%CVE-2020-7038HIGHAvaya Meetings Server Information Disclosure vulnerabilityEPSS 1.3%CVE-2021-1577CRITICALCisco Application Policy Infrastructure Controller Arbitrary File Read and Write VulnerabilityEPSS 1.3%