Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2023-2183MEDIUMGrafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel EPSS 1.0%CVE-2025-2549MEDIUMD-Link DIR-618/DIR-605L formSetPassword access controlEPSS 1.0%CVE-2017-8438—Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitionEPSS 1.0%CVE-2022-40798HIGHOcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request withEPSS 1.0%CVE-2024-24386HIGHAn issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.EPSS 1.0%CVE-2022-23730—The public API error causes for the attacker to be able to bypass API access control.EPSS 1.0%CVE-2023-39962HIGHUsers can delete external storage mount pointsEPSS 1.0%CVE-2025-46628HIGHLack of input validation/sanitization in the 'ate' management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attackeEPSS 1.0%CVE-2023-24058MEDIUMBooked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservatioEPSS 1.0%CVE-2021-21965HIGHA denial of service vulnerability exists in the SeaMax remote configuration functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34.EPSS 1.0%CVE-2022-32789MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferencEPSS 1.0%CVE-2020-8278—Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.EPSS 1.0%CVE-2022-23768HIGHNeo Information Sys. NIS-HAP11AC remote access and manipulation vulnerabilityEPSS 1.0%CVE-2024-13108MEDIUMD-Link DIR-816 A2 form2NetSniper.cgi access controlEPSS 1.0%CVE-2021-1478MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 1.0%CVE-2020-26072HIGHCisco IoT Field Network Director SOAP API Authorization Bypass VulnerabilityEPSS 1.0%CVE-2022-0731MEDIUMImproper Access Control (IDOR) in dolibarr/dolibarrEPSS 1.0%CVE-2024-26029HIGHAdobe Experience Manager | Improper Access Control (CWE-284)EPSS 1.0%CVE-2021-34754MEDIUMCisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass VulnerabilitiesEPSS 1.0%CVE-2023-40060HIGH2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1EPSS 1.0%