Falhas do tipo CWE-441

231 resultados

Deputado Confuso (intermediário não intencional)

Ocorre quando um programa confiável é explorado para executar ações em nome de um atacante, porque não valida corretamente quem está pedindo e em qual contexto. O programa age como intermediário involuntário, abusando de seus privilégios para fazer algo que não deveria.

Exemplo

Um serviço web roda com permissões altas e aceita uma URL ou caminho como parâmetro sem validar a origem. Um atacante envia requisição malformada que o serviço interpreta como vindo de um usuário legítimo, causando dele mesmo deletar arquivos ou acessar dados sensíveis que o atacante sozinho não poderia.

Como mitigar

Valide rigorosamente a origem, contexto e intenção de cada requisição (quem está pedindo, de onde, e se tem direito). Implemente verificação de autenticação robusta, use tokens com escopo limitado (OAuth 2.0), e nunca confie apenas em parâmetros do usuário para tomar decisões de segurança ou privilégio.

CVE-2026-28616HIGHIn Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalatEPSS 0.1%CVE-2026-56945HIGHIn VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additionaEPSS 0.1%CVE-2026-0107HIGHIn gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. This could lead to locEPSS 0.1%CVE-2025-32326HIGHIn multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. ThEPSS 0.1%CVE-2025-32321HIGHIn isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This cEPSS 0.1%CVE-2025-48555HIGHIn multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This cEPSS 0.1%CVE-2025-48536HIGHIn grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settingsEPSS 0.1%CVE-2025-48529MEDIUMIn setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy. This could EPSS 0.1%CVE-2026-45519LOWIn screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This coEPSS 0.1%CVE-2025-48532HIGHIn markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused depuEPSS 0.1%CVE-2026-106326MEDIUMConfused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions inEPSS 0.1%CVE-2023-21082MEDIUMIn getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number EPSS 0.1%CVE-2025-48628HIGHIn validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could leadEPSS 0.1%CVE-2025-32346HIGHIn onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This cEPSS 0.1%CVE-2025-22420HIGHIn multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local eEPSS 0.1%CVE-2025-26452HIGHIn loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. ThiEPSS 0.1%CVE-2025-48551MEDIUMIn multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy. This could EPSS 0.1%CVE-2025-22416HIGHIn onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to localEPSS 0.1%CVE-2025-22418HIGHIn multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no EPSS 0.1%CVE-2025-32320HIGHIn System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilegeEPSS 0.1%