Falhas do tipo CWE-284

7.967 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2025-7565MEDIUMLB-LINK BL-AC3600 Web Management Interface lighttpd.cgi geteasycfg information disclosureEPSS 0.8%CVE-2024-37905HIGHImproper Access Control and Incorrect Authorization in github.com/goauthentik/authentikEPSS 0.8%CVE-2025-54603CRITICALAn incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonationEPSS 0.8%CVE-2022-42707HIGHIn Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible withoutEPSS 0.8%CVE-2023-43119—An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to EPSS 0.8%CVE-2023-1862HIGHRemote access to warp-svc.exe in Cloudflare WARPEPSS 0.8%CVE-2022-1066HIGHMISSING AUTHORIZATION CWE-862EPSS 0.8%CVE-2022-45936HIGHA vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle accEPSS 0.8%CVE-2026-121618MEDIUMLinksys E5600 Factory Quality Control fqc.cgi information disclosureEPSS 0.8%CVE-2023-21750HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-41155MEDIUMWordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerabilityEPSS 0.8%CVE-2025-46816CRITICALgoshs route not protected, allows command executionEPSS 0.8%CVE-2024-12954MEDIUM1000 Projects Portfolio Management System MCA update_ach.php unrestricted uploadEPSS 0.7%CVE-2024-12953MEDIUM1000 Projects Portfolio Management System MCA update_pd_process.php unrestricted uploadEPSS 0.7%CVE-2014-8183HIGHIt was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An atEPSS 0.7%CVE-2021-41543—A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V1EPSS 0.7%CVE-2022-24924LOWAn improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a prEPSS 0.7%CVE-2018-15372—Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass VulnerabilityEPSS 0.7%CVE-2023-5240—Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAEPSS 0.7%CVE-2023-30587HIGHA vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspectEPSS 0.7%