Falhas do tipo CWE-346

698 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2024-24782MEDIUMHIMA: Origin Validation Error in multiple productsEPSS 0.2%CVE-2026-45173HIGHIdira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation FailureEPSS 0.2%CVE-2026-11214MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-originEPSS 0.2%CVE-2025-59845HIGHApollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypassEPSS 0.2%CVE-2026-108362CRITICALPrivasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)EPSS 0.2%CVE-2026-11291MEDIUMInappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass sameEPSS 0.2%CVE-2026-11298MEDIUMInappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origiEPSS 0.2%CVE-2023-27962MEDIUMA logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. AnEPSS 0.2%CVE-2022-42860—This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 1EPSS 0.2%CVE-2026-7643MEDIUMChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policyEPSS 0.2%CVE-2026-12024MEDIUMInsufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy EPSS 0.2%CVE-2026-74934HIGHSite isolation issue in the Graphics: CanvasWebGL componentEPSS 0.2%CVE-2025-69235HIGHWhale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.EPSS 0.2%CVE-2026-74968MEDIUMSite isolation issue in the Graphics: WebRender componentEPSS 0.2%CVE-2026-92704HIGHSharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionEPSS 0.2%CVE-2026-11048MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malEPSS 0.2%CVE-2026-74970MEDIUMSite isolation issue in the Graphics componentEPSS 0.2%CVE-2026-116592HIGHundici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hopsEPSS 0.2%CVE-2026-7979MEDIUMInappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafEPSS 0.2%CVE-2026-41376LOWOpenClaw < 2026.3.31 - Matrix Thread Context Allowlist Bypass via Sender ValidationEPSS 0.2%