Falhas do tipo CWE-441

159 resultados

Deputado Confuso (intermediário não intencional)

Ocorre quando um programa confiável é explorado para executar ações em nome de um atacante, porque não valida corretamente quem está pedindo e em qual contexto. O programa age como intermediário involuntário, abusando de seus privilégios para fazer algo que não deveria.

Exemplo

Um serviço web roda com permissões altas e aceita uma URL ou caminho como parâmetro sem validar a origem. Um atacante envia requisição malformada que o serviço interpreta como vindo de um usuário legítimo, causando dele mesmo deletar arquivos ou acessar dados sensíveis que o atacante sozinho não poderia.

Como mitigar

Valide rigorosamente a origem, contexto e intenção de cada requisição (quem está pedindo, de onde, e se tem direito). Implemente verificação de autenticação robusta, use tokens com escopo limitado (OAuth 2.0), e nunca confie apenas em parâmetros do usuário para tomar decisões de segurança ou privilégio.

CVE-2026-55430MEDIUMCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessEPSS 0.2%CVE-2026-27124HIGHFastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesEPSS 0.2%CVE-2026-53514HIGHBetter Auth: Unauthorized invitation acceptance via unverified email match in organization pluginEPSS 0.2%CVE-2025-11393HIGHInsights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commandsEPSS 0.2%CVE-2026-91742MEDIUMConfused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering tEPSS 0.2%CVE-2026-44964MEDIUMIn versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guardEPSS 0.2%CVE-2026-55225HIGHStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`EPSS 0.2%CVE-2026-13062HIGHMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded ClustersEPSS 0.2%CVE-2026-36608HIGHMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admEPSS 0.2%CVE-2026-54663MEDIUMswagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`EPSS 0.2%CVE-2025-66415MEDIUMfastify-reply-from bypass of reply forwardingEPSS 0.2%CVE-2026-41365MEDIUMOpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread HistoryEPSS 0.2%CVE-2025-25306CRITICALMisskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated NotesEPSS 0.2%CVE-2024-31319HIGHIn updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a conEPSS 0.2%CVE-2026-84329MEDIUMConfused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised thEPSS 0.2%CVE-2026-87502MEDIUMConfused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process andEPSS 0.2%CVE-2026-9595MEDIUMwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesEPSS 0.2%CVE-2026-0013HIGHIn setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This couldEPSS 0.2%CVE-2026-44992MEDIUMOpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenvEPSS 0.1%CVE-2026-84616MEDIUMA type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, mEPSS 0.1%