Falhas do tipo CWE-697

80 resultados

Comparação incorreta

O código compara valores ou objetos de forma inadequada, usando operadores errados ou não considerando o tipo de dados envolvido. Isso permite que condições de segurança sejam contornadas: um atacante entra onde não deveria porque a lógica de comparação não funciona como o desenvolvedor pretendia.

Exemplo

Um sistema valida acesso comparando a string do token com == em vez de usar comparação constante: se (token == tokenEsperado). Um atacante testa strings como '0' ou null que podem ser iguais por coerção de tipo, burlando a autenticação.

Como mitigar

Use operadores de comparação apropriados ao tipo (=== ou equals() em vez de ==), implemente comparação constante-time para valores sensíveis (HMAC ou funções específicas), e valide tipos explicitamente antes de comparar. Em java, use .equals() ou MessageDigest.isEqual(); em Python, use == com casting apropriado ou bibliotecas como secrets.compare_digest().

CVE-2020-5849HIGHUnraid 6.8.0 allows authentication bypass.EPSS 93.2%KEVCVE-2020-8864HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-EPSS 80.2%CVE-2025-3102HIGHSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS 75.7%CVE-2020-8862HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC0EPSS 13.3%CVE-2023-23840MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-23845MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-33225HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 3.2%CVE-2023-23843HIGHSolarWinds Platform Incorrect Comparison VulnerabilityEPSS 2.6%CVE-2022-43621HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. AutEPSS 2.2%CVE-2022-41317MEDIUMAn issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be ExposurEPSS 1.7%CVE-2015-9238—secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, EPSS 1.5%CVE-2023-28936MEDIUMApache OpenMeetings: insufficient check of invitation hashEPSS 1.2%CVE-2024-24621CRITICALSoftaculous Webuzo Authentication BypassEPSS 1.2%CVE-2021-3833CRITICALIntegria IMS incorrect authorizationEPSS 1.1%CVE-2024-34340CRITICALAuthentication Bypass when using using older password hashesEPSS 1.1%CVE-2021-0295MEDIUMJunos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.EPSS 1.1%CVE-2024-4032HIGHIncorrect IPv4 and IPv6 private rangesEPSS 1.1%CVE-2022-22203MEDIUMJunos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC rebootEPSS 1.1%CVE-2020-15131HIGHFalse-positive validity for NFT1 genesis transactions in SLP ValidateEPSS 1.0%CVE-2020-11072HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 1.0%