Falhas do tipo CWE-602

185 resultados

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega uma função de segurança para o cliente executar, assumindo que o cliente vai implementar ou respeitar essa proteção. Na prática, o atacante controla o cliente e pode contornar ou desabilitar o mecanismo, comprometendo a segurança do servidor. É um erro fundamental de arquitetura: nunca confie em validações ou controles que rodem no lado do cliente.

Exemplo

Um servidor web que valida permissões apenas via JavaScript no navegador, permitindo ao usuário editar o HTML/JS localmente e contornar as restrições. Ou uma API que depende do cliente para não enviar dados além de um limite, sem validar no servidor.

Como mitigar

Implemente todas as validações críticas de segurança (autenticação, autorização, limite de taxa, validação de entrada) obrigatoriamente no servidor. Trate o cliente como potencialmente adversário e nunca confie em nada que venha dele sem re-validar no backend.

CVE-2025-10640CRITICALMissing Server-Side Authentication Checks in EfficientLab WorkExaminer ProfessionalEPSS 0.9%CVE-2022-1525CRITICALCognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side SecurityEPSS 0.9%CVE-2024-31491HIGHA client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2EPSS 0.8%CVE-2022-3308HIGHInsufficient policy enforcement in developer tools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially perform EPSS 0.8%CVE-2025-27681CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-EPSS 0.8%CVE-2020-5345MEDIUMDell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, anEPSS 0.7%CVE-2023-0581MEDIUMPrivateContent <= 8.4.3 - Protection Mechanism BypassEPSS 0.7%CVE-2026-54104HIGHU.S. GAO EPDS and CBCA EDS client-based privilege escalationEPSS 0.7%CVE-2025-40591HIGHA vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEEPSS 0.7%CVE-2026-45274MEDIUMMyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER EnforcementEPSS 0.7%CVE-2021-21531HIGHDell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user wiEPSS 0.7%CVE-2023-23570MEDIUM Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid configuration with undeEPSS 0.7%CVE-2024-28029HIGHClient-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergieEPSS 0.7%CVE-2026-30933HIGHFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoEPSS 0.6%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%CVE-2022-3310MEDIUMInsufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the userEPSS 0.6%CVE-2025-54833MEDIUMOPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypassEPSS 0.6%CVE-2025-4527MEDIUMDígitro NGC Explorer Password Transmission client-side enforcement of server-side securityEPSS 0.6%CVE-2024-52008LOWPassword Policy Bypass Vulnerability in Fides WebserverEPSS 0.6%CVE-2024-0701MEDIUMUserPro <= 5.1.6 - Disabled Membership Registration BypassEPSS 0.6%