Falhas do tipo CWE-441

233 resultados

Deputado Confuso (intermediário não intencional)

Ocorre quando um programa confiável é explorado para executar ações em nome de um atacante, porque não valida corretamente quem está pedindo e em qual contexto. O programa age como intermediário involuntário, abusando de seus privilégios para fazer algo que não deveria.

Exemplo

Um serviço web roda com permissões altas e aceita uma URL ou caminho como parâmetro sem validar a origem. Um atacante envia requisição malformada que o serviço interpreta como vindo de um usuário legítimo, causando dele mesmo deletar arquivos ou acessar dados sensíveis que o atacante sozinho não poderia.

Como mitigar

Valide rigorosamente a origem, contexto e intenção de cada requisição (quem está pedindo, de onde, e se tem direito). Implemente verificação de autenticação robusta, use tokens com escopo limitado (OAuth 2.0), e nunca confie apenas em parâmetros do usuário para tomar decisões de segurança ou privilégio.

CVE-2024-30128HIGHAn open proxy vulnerability affects HCL Nomad server on DominoEPSS 0.4%CVE-2026-42313HIGHpyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxyEPSS 0.4%CVE-2024-34068MEDIUMServer-side Request Forgery during remote file pull in Pterodactyl wingsEPSS 0.4%CVE-2024-9870MEDIUMUnintended Proxy or Intermediary ('Confused Deputy') in GitLabEPSS 0.4%CVE-2026-87582HIGHConfused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process tEPSS 0.4%CVE-2026-73079HIGHSub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentialsEPSS 0.4%CVE-2026-73424MEDIUMAstro: Unauthenticated path override in the @astrojs/vercel ISR functionEPSS 0.4%CVE-2026-16158HIGH@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collisionEPSS 0.4%CVE-2026-113024HIGHConfused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafteEPSS 0.4%CVE-2026-113202HIGHConfused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to EPSS 0.4%CVE-2026-113301HIGHConfused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions viaEPSS 0.4%CVE-2026-72640MEDIUMUnintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret DisclosureEPSS 0.4%CVE-2026-106228HIGHConfused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process toEPSS 0.4%CVE-2026-113127HIGHConfused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged pEPSS 0.4%CVE-2026-101897MEDIUMAngular DevTools (Local DoS)EPSS 0.4%CVE-2026-73266HIGHClusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset joinEPSS 0.4%CVE-2026-24471CRITICALImproper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')EPSS 0.3%CVE-2026-27624HIGHCoturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACLEPSS 0.3%CVE-2026-33768MEDIUMAstro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`EPSS 0.3%CVE-2026-53999HIGHRadius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)EPSS 0.3%