Falhas do tipo CWE-346

588 resultados

Validação inadequada de origem (CORS/mesma origem)

A aplicação falha em validar corretamente a origem (domain/protocolo/porta) das requisições, permitindo que código malicioso de outros domínios acesse recursos protegidos. Isso quebra a política de mesma origem do navegador e pode expor dados sensíveis ou permitir ações não autorizadas.

Exemplo

Um servidor aceita qualquer valor no header Origin sem validação, ou valida de forma fraca (ex: substring matching). Um atacante hospeda um site malicioso que, ao ser visitado, faz requisições CORS para a aplicação vulnerável e consegue ler dados da vítima autenticada.

Como mitigar

Implemente validação rigorosa de origem: compare o header Origin contra uma whitelist explícita de domínios confiáveis (nunca use wildcards), valide protocolo e porta também, e desative CORS se não for necessário. Use credenciais com cautela em requisições cross-origin (credenciais + Access-Control-Allow-Origin: * é inseguro).

CVE-2024-41475CRITICALGnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.EPSS 0.3%CVE-2025-71217HIGHAn origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to eEPSS 0.3%CVE-2025-24010MEDIUMVite allows any websites to send any requests to the development server and read the responseEPSS 0.3%CVE-2024-5549HIGHData leak through CORS misconfiguration in stitionai/devikaEPSS 0.3%CVE-2026-57989HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-8487HIGHCORS Vulnerability in modelscope/agentscopeEPSS 0.3%CVE-2025-4839LOWitwanger paicoding CrossUtil.java cross-domain policyEPSS 0.3%CVE-2022-29915MEDIUMThe Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affectEPSS 0.3%CVE-2023-37210—A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoEPSS 0.3%CVE-2026-17743MEDIUMInsufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pEPSS 0.3%CVE-2026-17754MEDIUMInappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a cEPSS 0.3%CVE-2026-17748MEDIUMInappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-17787MEDIUMInappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via EPSS 0.3%CVE-2026-17763MEDIUMInappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2026-17815MEDIUMInsufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%CVE-2026-17742MEDIUMInsufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17733MEDIUMInappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data EPSS 0.3%CVE-2026-17820MEDIUMInsufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via EPSS 0.3%CVE-2026-17765MEDIUMInappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereEPSS 0.3%CVE-2026-17829MEDIUMInsufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaEPSS 0.3%