Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2018-11456—A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device EPSS 1.3%CVE-2024-3765CRITICALXiongmai AHB7804R-MH-V2 Sofia Service access controlEPSS 1.3%CVE-2019-10200—A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedulEPSS 1.3%CVE-2023-1834CRITICALRockwell Automation Kinetix 5500 Vulnerable to Open Port ExploitationEPSS 1.3%CVE-2022-0133MEDIUMImproper Access Control in chocobozzz/peertubeEPSS 1.3%CVE-2022-26346CRITICALA denial of service vulnerability exists in the ucloud_del_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafteEPSS 1.3%CVE-2022-1553HIGHLeaking password protected articles content due to improper access control in publify/publifyEPSS 1.2%CVE-2020-14312—A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat EnterpriseEPSS 1.2%CVE-2024-45489CRITICALArc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (beEPSS 1.2%CVE-2021-1389MEDIUMCisco IOS XR and Cisco NX-OS Software IPv6 Access Control List Bypass VulnerabilityEPSS 1.2%CVE-2021-24197—wpDataTables < 3.4.2 - Improper Access Control leading to Table Permission TakeoverEPSS 1.2%CVE-2024-43600HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2019-10964HIGHMedtronic MiniMed 508 and Paradigm Series Insulin Pumps Improper Access ControlEPSS 1.2%CVE-2021-40404MEDIUMAn authentication bypass vulnerability exists in the cgiserver.cgi Login functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-EPSS 1.2%CVE-2026-24300CRITICALAzure Front Door Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2025-27744HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-0205MEDIUMJunos OS: MX Series: Dynamic filter fails to match IPv6 prefixEPSS 1.2%CVE-2020-13677—Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintendEPSS 1.2%CVE-2022-0203HIGHImproper Access Control in crater-invoice/craterEPSS 1.2%CVE-2021-26334—AMD Chipset Driver Information Disclosure VulnerabilityEPSS 1.2%