Falhas do tipo CWE-287

2.850 resultados

Autenticação Insuficiente ou Ausente

Quando um usuário ou sistema afirma ser quem diz que é, a aplicação não valida (ou valida mal) essa identidade antes de conceder acesso. Isso permite que um atacante se passe por outra pessoa sem fornecer credenciais válidas, obtendo privilégios indevidos.

Exemplo

Um sistema que aceita login apenas verificando um campo de e-mail na sessão (sem senha), ou uma API que confia em um identificador de usuário enviado no header HTTP sem validar um token assinado. Um atacante simplesmente muda o valor e acessa dados de terceiros.

Como mitigar

Implemente autenticação robusta: exija senha forte + MFA quando possível, valide tokens com assinatura criptográfica, revoque sessões expiradas, e nunca confie em dados controlados pelo cliente. Teste autenticação em cada endpoint crítico.

CVE-2024-36264CRITICALApache Submarine Commons Utils: default secretEPSS 1.0%CVE-2026-62144CRITICALManagement Authentication Bypass and Privilege EscalationEPSS 1.0%CVE-2023-50275HIGHHPE OneView may allow clusterService Authentication Bypass resulting in denial of service.EPSS 1.0%CVE-2022-2572CRITICALIn affected versions of Octopus Server where access is managed by an external authentication provider, it was possible that the API key/keysEPSS 1.0%CVE-2020-1718HIGHA flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized accesEPSS 1.0%CVE-2022-30238HIGHA CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacksEPSS 1.0%CVE-2020-16239MEDIUMPhilips SureSigns VS4 Improper AuthenticationEPSS 1.0%CVE-2024-6248HIGHWyze Cam v3 Cloud Infrastructure Improper Authentication Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-0193HIGHImproper authentication in the Intel(R) In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enabEPSS 1.0%CVE-2023-1784MEDIUMjeecg-boot API Documentation improper authenticationEPSS 1.0%CVE-2022-22730CRITICALImproper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to poteEPSS 1.0%CVE-2022-39257HIGHMatrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.0%CVE-2022-39248HIGHmatrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionEPSS 1.0%CVE-2022-3465HIGHMediabridge Medialink index.asp improper authenticationEPSS 1.0%CVE-2021-39138MEDIUMNew anonymous user session acts as if it's created with passwordEPSS 1.0%CVE-2022-2662CRITICALSequi PortBloque S Improper AuthenticationEPSS 1.0%CVE-2020-10754MEDIUMIt was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when cEPSS 1.0%CVE-2020-3197MEDIUMCisco Meetings App Missing TURN Server Credentials Expiration VulnerabilityEPSS 1.0%CVE-2023-6354MEDIUMTyler Technologies Magistrate Court Case Management Plus PDFViewer.aspx allows authentication bypassEPSS 1.0%CVE-2023-6353MEDIUMTyler Technologies Civil and Criminal Electronic Filing Upload.aspx allows authentication bypassEPSS 1.0%