Falhas do tipo CWE-284

7.074 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2022-38935HIGHAn issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/EPSS 0.7%CVE-2024-7921MEDIUMAnhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access controlEPSS 0.7%CVE-2024-21418HIGHSoftware for Open Networking in the Cloud (SONiC) Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-7920MEDIUMAnhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access controlEPSS 0.7%CVE-2018-17921—SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without EPSS 0.7%CVE-2021-26909LOWAutomox Agent Guessable S3 Bucket EndpointEPSS 0.7%CVE-2022-45936HIGHA vulnerability has been identified in Mendix Email Connector (All versions < V2.0.0). Affected versions of the module improperly handle accEPSS 0.7%CVE-2021-35249MEDIUMDomain Admin Broken Access ControlEPSS 0.7%CVE-2026-40498HIGHFreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cronEPSS 0.7%CVE-2022-1658MEDIUMJupiter Theme <= 6.10.1 - Authenticated Arbitrary Plugin DeletionEPSS 0.7%CVE-2026-34045HIGHPodman Desktop WebView Server ExposedEPSS 0.7%CVE-2020-9754—NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.EPSS 0.7%CVE-2023-22805MEDIUMCVE-2023-22805EPSS 0.7%CVE-2023-26770CRITICALTaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of tEPSS 0.7%CVE-2024-21071CRITICALVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that aEPSS 0.7%CVE-2023-22903CRITICALapi/views/user.py in LibrePhotos before e19e539 has incorrect access control.EPSS 0.7%CVE-2024-44313HIGHTastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized EPSS 0.7%CVE-2026-42074CRITICALOpenClaude: Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` InputEPSS 0.7%CVE-2023-30583HIGHfs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in EPSS 0.7%CVE-2020-3413MEDIUMCisco Webex Meetings Scheduled Meeting Template Deletion VulnerabilityEPSS 0.7%