Falhas do tipo CWE-346

587 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2024-26135HIGHMeshCentral cross-site websocket hijacking (CSWSH) vulnerabilityEPSS 0.5%CVE-2023-27745HIGHAn issue in South River Technologies TitanFTP Before v2.0.1.2102 allows attackers with low-level privileges to perform Administrative actionEPSS 0.5%CVE-2026-16745HIGHOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validationEPSS 0.5%CVE-2020-26251MEDIUMCORS configuration is possibly vulnerableEPSS 0.5%CVE-2023-29867MEDIUMZammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accountsEPSS 0.5%CVE-2024-7978MEDIUMInsufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to eEPSS 0.4%CVE-2024-1249HIGHKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosEPSS 0.4%CVE-2024-14006HIGHNagios XI < 2024R1.2.2 Host Header InjectionEPSS 0.4%CVE-2026-23552CRITICALApache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicyEPSS 0.4%CVE-2019-25211CRITICALparseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.comEPSS 0.4%CVE-2023-30996MEDIUMIBM Cognos Analytics cross-origin resource sharingEPSS 0.4%CVE-2024-32764CRITICALmyQNAPcloud LinkEPSS 0.4%CVE-2026-58169HIGHVibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionEPSS 0.4%CVE-2022-42927HIGHA same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.EPSS 0.4%CVE-2021-47157CRITICALThe Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.EPSS 0.4%CVE-2023-20275MEDIUMA vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTEPSS 0.4%CVE-2023-25366CRITICALIn Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS, insecure SCPI interface discloses web password.EPSS 0.4%CVE-2022-23032—In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP EPSS 0.4%CVE-2024-9393HIGHAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This coulEPSS 0.4%CVE-2022-30228HIGHA vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin rEPSS 0.4%