Falhas do tipo CWE-284

7.070 resultados

Controle de acesso inadequado a recursos

A aplicação falha em validar ou aplica incorretamente as restrições de acesso, permitindo que usuários não autorizados acessem dados ou funcionalidades que deveriam estar protegidas. É uma das fragilidades mais comuns em segurança: o código não verifica corretamente quem está pedindo acesso e simplesmente concede.

Exemplo

Um e-commerce que permite acessar o perfil de qualquer cliente substituindo o ID na URL (ex: /usuario/123 → /usuario/124), sem validar se o usuário autenticado é o dono daquele perfil. Um atacante consegue ver dados pessoais, histórico de compras e endereços de outras pessoas.

Como mitigar

Implemente verificações explícitas em cada acesso a recurso: autentique o usuário, identifique qual recurso ele quer acessar, e valide se as permissões dele cobrem aquele recurso específico. Use listas de controle de acesso (ACLs) ou papéis (RBAC/ABAC) consistentemente em toda a API ou aplicação, nunca deixando a segurança implícita.

CVE-2022-22282—SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connectionEPSS 7.8%CVE-2019-3934—Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP EPSS 7.7%CVE-2024-5655CRITICALImproper Access Control in GitLabEPSS 7.5%CVE-2022-36923MEDIUMZoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils EPSS 7.1%CVE-2023-37759—Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to regiEPSS 7.0%CVE-2025-25948CRITICALIncorrect access control in the component /rest/staffResource/create of Serosoft Solutions Pvt Ltd Academia Student Information System (SIS)EPSS 6.9%CVE-2021-36888CRITICALWordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromiseEPSS 6.7%CVE-2025-56241HIGHAztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator passwoEPSS 6.7%CVE-2017-7918—An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attackerEPSS 6.7%CVE-2023-0744CRITICALImproper Access Control in answerdev/answerEPSS 6.4%CVE-2024-6385CRITICALImproper Access Control in GitLabEPSS 6.1%CVE-2022-32212—A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that EPSS 6.1%CVE-2019-3933—Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /iEPSS 5.9%CVE-2019-13656CRITICALAn access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows aEPSS 5.8%CVE-2025-20242MEDIUMA vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacEPSS 5.7%CVE-2023-21752HIGHWindows Backup Service Elevation of Privilege VulnerabilityEPSS 5.3%CVE-2012-6068CRITICAL3S CoDeSys Improper Access ControlEPSS 5.3%CVE-2026-18886CRITICALUnauthenticated Privilege Escalation via System Configuration Image Upload ProcessorEPSS 5.0%CVE-2024-26234MEDIUMProxy Driver Spoofing VulnerabilityEPSS 4.9%CVE-2009-2631—Clientless SSL VPN products break web browser domain-based security modelsEPSS 4.8%