Falhas do tipo CWE-441

233 resultados

Deputado Confuso (intermediário não intencional)

Ocorre quando um programa confiável é explorado para executar ações em nome de um atacante, porque não valida corretamente quem está pedindo e em qual contexto. O programa age como intermediário involuntário, abusando de seus privilégios para fazer algo que não deveria.

Exemplo

Um serviço web roda com permissões altas e aceita uma URL ou caminho como parâmetro sem validar a origem. Um atacante envia requisição malformada que o serviço interpreta como vindo de um usuário legítimo, causando dele mesmo deletar arquivos ou acessar dados sensíveis que o atacante sozinho não poderia.

Como mitigar

Valide rigorosamente a origem, contexto e intenção de cada requisição (quem está pedindo, de onde, e se tem direito). Implemente verificação de autenticação robusta, use tokens com escopo limitado (OAuth 2.0), e nunca confie apenas em parâmetros do usuário para tomar decisões de segurança ou privilégio.

CVE-2025-68944MEDIUMGitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.EPSS 0.3%CVE-2026-87453MEDIUMConfused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2022-39349MEDIUMTasks.org vulnerable to data exfiltration by malicous app or adbEPSS 0.3%CVE-2026-84329MEDIUMConfused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2026-93294MEDIUMAzure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIsEPSS 0.3%CVE-2026-106487LOWBackstage: Unsupported catalog cluster authentication mode in kubernetes backendEPSS 0.3%CVE-2026-121171HIGHConfused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web orEPSS 0.3%CVE-2026-114478MEDIUMUnintended Proxy or Intermediary ('Confused Deputy') in hMailServerEPSS 0.3%CVE-2025-64125CRITICALNuvation Energy nCloud Client-to-Client CommunicationEPSS 0.3%CVE-2026-121108HIGHConfused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policyEPSS 0.3%CVE-2026-106359MEDIUMConfused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin poliEPSS 0.3%CVE-2026-113099HIGHConfused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to oEPSS 0.3%CVE-2026-53513CRITICALBetter Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registrationEPSS 0.2%CVE-2026-87442LOWConfused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pEPSS 0.2%CVE-2026-107336MEDIUMAuthentication Bypass by Spoofing in MalcolmEPSS 0.2%CVE-2026-106301HIGHConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-49821HIGHFission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltrationEPSS 0.2%CVE-2026-106266MEDIUMConfused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proceEPSS 0.2%CVE-2026-50169MEDIUMAngular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesEPSS 0.2%CVE-2026-106188MEDIUMConfused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictioEPSS 0.2%