Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2020-11020HIGHAuthentication and extension bypass in FayeEPSS 1.6%CVE-2014-5412—Schneider Electric SCADA Expert ClearSCADA Improper AuthenticationEPSS 1.6%CVE-2022-39042CRITICALaEnrich a+HRD - Improper AuthenticationEPSS 1.6%CVE-2022-20798CRITICALCisco Email Security Appliance and Cisco Secure Email and Web Manager External Authentication Bypass VulnerabilityEPSS 1.6%CVE-2007-4043CRITICALfile.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers to bypass authentication EPSS 1.6%CVE-2017-6711—A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker EPSS 1.6%CVE-2022-43504MEDIUMImproper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addrEPSS 1.6%CVE-2022-37914CRITICALVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attEPSS 1.5%CVE-2022-37913CRITICALVulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attEPSS 1.5%CVE-2018-12472HIGHAuthentication bypass in sibling checkEPSS 1.5%CVE-2024-21427HIGHWindows Kerberos Security Feature Bypass VulnerabilityEPSS 1.5%CVE-2020-36533LOWKlapp App JSON Web Token improper authenticationEPSS 1.5%CVE-2022-31013CRITICALAuthentication bypass in Vartalap chat-serverEPSS 1.5%CVE-2024-27834MEDIUMThe issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, maEPSS 1.5%KEVCVE-2022-22935LOWAn issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MEPSS 1.5%CVE-2021-21538CRITICALDell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthentEPSS 1.5%CVE-2021-3652—A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inEPSS 1.5%CVE-2026-78167CRITICALEFM ipTIME T16000M Session Validation httpcon_check_session_url improper authenticationEPSS 1.5%CVE-2023-29463HIGHPavilion8 Security Misconfiguration VulnerabilityEPSS 1.5%CVE-2025-1723HIGHAccount takeoverEPSS 1.5%