Falhas do tipo CWE-471

36 resultados

Modificação de dados presumidamente imutáveis

Ocorre quando código confia que certos dados não serão alterados, mas alguém consegue modificá-los — seja por acesso direto à memória, referência compartilhada não protegida ou falta de validação. O desenvolvedor assume imutabilidade que não existe, criando comportamento imprevisto ou exploração de segurança.

Exemplo

Uma aplicação armazena uma constante de nível de acesso do usuário em memória e a valida uma vez no login. Um atacante, porém, modifica essa variável diretamente via overflow de buffer ou manipulação de estrutura de dados compartilhada, elevando seu próprio privilégio sem revalidação.

Como mitigar

Use estruturas de dados realmente imutáveis (como constantes finais em Java, objetos congelados em Python), revalide dados críticos em cada ponto de decisão, e proteja a memória contra acesso não autorizado com controles de acesso apropriados (ASLR, canários de pilha, sandboxing).

CVE-2022-21824—Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "propertiesEPSS 21.5%CVE-2018-3728—hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' EPSS 4.2%CVE-2020-8147—Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remotEPSS 3.1%CVE-2020-8116—Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbiEPSS 3.1%CVE-2018-3721—lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and merEPSS 2.4%CVE-2018-3719—mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious useEPSS 2.1%CVE-2020-8158—Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further EPSS 2.1%CVE-2018-3723—defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious EPSS 2.0%CVE-2018-3722—merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious useEPSS 2.0%CVE-2018-3720—assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious usEPSS 2.0%CVE-2020-26245HIGHPrototype Pollution leading to Command Injection in systeminformationEPSS 1.9%CVE-2020-15256HIGHPrototype pollution in object-pathEPSS 1.5%CVE-2022-25893CRITICALArbitrary Code ExecutionEPSS 1.4%CVE-2020-26237MEDIUMPrototype Pollution in highlight.jsEPSS 1.3%CVE-2020-8268—Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties ofEPSS 1.3%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2021-24046—A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the FaceboEPSS 0.7%CVE-2022-3288LOWA branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows anEPSS 0.7%CVE-2023-43697MEDIUM Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load EPSS 0.6%CVE-2024-34517MEDIUMThe Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin acceEPSS 0.6%