Falhas do tipo CWE-424

49 resultados

Proteção inadequada de caminhos alternativos

O software protege um caminho ou recurso principal, mas deixa desprotegido um caminho alternativo que leva ao mesmo destino. Um atacante contorna as validações da rota esperada usando uma entrada equivalente que não foi validada adequadamente.

Exemplo

Uma aplicação bloqueia acesso a '/admin/painel' com autenticação, mas não valida '/admin/../painel' ou a codificação alternativa da URL. O atacante usa o caminho alternativo e bypassa a proteção porque a validação foi implementada apenas para o caminho canônico.

Como mitigar

Normalize todas as entradas (URLs, caminhos de arquivo, paths) antes de validar, removendo caracteres especiais e resolvendo referências relativas (/../). Aplique as mesmas regras de autenticação e autorização para qualquer variação de acesso ao recurso sensível, não apenas a forma esperada.

CVE-2024-58136CRITICALYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iEPSS 87.8%KEVCVE-2025-48827CRITICALvBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningEPSS 75.6%CVE-2025-48828CRITICALCertain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By cEPSS 57.3%CVE-2019-18997MEDIUMPB610 HMISimulator provides interface with access to arbitrary filesEPSS 1.5%CVE-2023-20272MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplEPSS 0.9%CVE-2026-66756MEDIUMApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseEPSS 0.7%CVE-2021-3793MEDIUMAn improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated EPSS 0.7%CVE-2026-82754MEDIUMash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsEPSS 0.7%CVE-2026-114659HIGHGrav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API RoutesEPSS 0.6%CVE-2024-8311MEDIUMImproper Protection of Alternate Path in GitLabEPSS 0.6%CVE-2026-4913MEDIUMImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenEPSS 0.6%CVE-2026-82586HIGHAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesEPSS 0.5%CVE-2026-58428MEDIUMRelease attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)EPSS 0.5%CVE-2026-86145HIGHPCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching worksEPSS 0.4%CVE-2024-3927MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassEPSS 0.4%CVE-2019-18996HIGHABB PB610 HMIStudio accepts malicious DLL file in an applicationEPSS 0.4%CVE-2026-76529CRITICALImproper Protection of Alternate Path in Splunk SOAREPSS 0.4%CVE-2026-69979MEDIUMWindows AppX Deployment Service Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2026-89039MEDIUMArbitrary file read via the convert_playwright_script prompt in mcp-k6EPSS 0.4%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%