Falhas do tipo CWE-602

185 resultados

Confiança inadequada em mecanismo de proteção implementado no cliente

O servidor delega uma função de segurança para o cliente executar, assumindo que o cliente vai implementar ou respeitar essa proteção. Na prática, o atacante controla o cliente e pode contornar ou desabilitar o mecanismo, comprometendo a segurança do servidor. É um erro fundamental de arquitetura: nunca confie em validações ou controles que rodem no lado do cliente.

Exemplo

Um servidor web que valida permissões apenas via JavaScript no navegador, permitindo ao usuário editar o HTML/JS localmente e contornar as restrições. Ou uma API que depende do cliente para não enviar dados além de um limite, sem validar no servidor.

Como mitigar

Implemente todas as validações críticas de segurança (autenticação, autorização, limite de taxa, validação de entrada) obrigatoriamente no servidor. Trate o cliente como potencialmente adversário e nunca confie em nada que venha dele sem re-validar no backend.

CVE-2026-14036HIGHInsufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalatiEPSS 0.3%CVE-2024-32512MEDIUMWordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerabilityEPSS 0.3%CVE-2024-52960MEDIUMA client-side enforcement of server-side security vulnerability [CWE-602] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and beEPSS 0.3%CVE-2026-16480MEDIUMIBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.EPSS 0.3%CVE-2024-49824MEDIUMIBM Robotic Process Automation security bypassEPSS 0.3%CVE-2022-31233MEDIUMUnisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially expEPSS 0.3%CVE-2026-30521MEDIUMA Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application EPSS 0.3%CVE-2026-14831MEDIUMEasy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration BypassEPSS 0.3%CVE-2024-42340HIGHCyberArk - CWE-602: Client-Side Enforcement of Server-Side SecurityEPSS 0.3%CVE-2024-43188MEDIUMIBM Business Automation Workflow improper input validationEPSS 0.3%CVE-2026-77793MEDIUMRegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price FieldEPSS 0.3%CVE-2026-42160CRITICALData Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backendEPSS 0.3%CVE-2025-47697MEDIUMClient-side enforcement of server-side security issue exists in wivia 5 all versions. If exploited, an unauthenticated attacker may bypass aEPSS 0.3%CVE-2026-11011HIGHInsufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised thEPSS 0.3%CVE-2025-36039MEDIUMIBM Aspera Faspex bypass securityEPSS 0.3%CVE-2026-25737HIGHBudibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)EPSS 0.3%CVE-2025-32359MEDIUMIn Zammad 6.4.x before 6.4.2, there is client-side enforcement of server-side security. When changing their two factor authentication configEPSS 0.3%CVE-2026-54047CRITICALLaci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration ManipulationEPSS 0.3%CVE-2026-116605MEDIUMSourceCodester Online Food Ordering System order.php client-side enforcement of server-side securityEPSS 0.3%CVE-2026-13871MEDIUMInsufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendeEPSS 0.3%