Falhas do tipo CWE-73
768 resultadosControle de acesso inadequado
A aplicação falha em validar ou enforçar corretamente quem pode acessar quais recursos ou funcionalidades. Isso permite que usuários não autorizados executem ações, visualizem dados sensíveis ou acessem áreas administrativas que deveriam estar restritas.
Exemplo
Um sistema bancário que valida se o usuário está logado, mas não verifica se ele tem permissão para acessar a conta de outro cliente — bastaria mudar o ID na URL (ex: `/conta/123` para `/conta/456`) para ver dados alheios.
Como mitigar
Implemente verificações de autorização em todas as operações sensíveis, não confie apenas em obscuridade de URLs ou IDs. Use listas de controle de acesso (ACL) ou papéis (RBAC) centralizados, e valide permissões no servidor antes de retornar qualquer dado ou executar ação.
CVE-2024-12058MEDIUMExternal control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a rEPSS 1.1%CVE-2018-19945—Improper Limitation of a Pathname to a Restricted Directory in QTSEPSS 1.1%CVE-2026-77621CRITICALVector: Arbitrary file write in the file sink via templated path (path traversal).EPSS 1.1%CVE-2023-35308MEDIUMWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 1.1%CVE-2026-52680CRITICALApache Kyuubi: REST batch multipart upload path traversal allows controlled file writeEPSS 1.1%CVE-2026-85684HIGHmarker through 2.0.0 Path Traversal via upload filenameEPSS 1.1%CVE-2026-53451CRITICALGround Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code executionEPSS 1.1%CVE-2026-54108MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.1%CVE-2026-49360HIGHRecce server has unauthenticated SQL execution that allows local file read/write through DuckDBEPSS 1.1%CVE-2023-49862MEDIUMAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev masteEPSS 1.1%CVE-2023-47171MEDIUMAn information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev masterEPSS 1.1%CVE-2023-49863MEDIUMAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev masteEPSS 1.1%CVE-2023-49864MEDIUMAn information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev masteEPSS 1.1%CVE-2025-29819MEDIUMWindows Admin Center in Azure Portal Information Disclosure VulnerabilityEPSS 1.1%CVE-2026-11527HIGHConfig::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandleEPSS 1.1%CVE-2026-30940HIGHbaserCMS: Path Traversal in Theme File API Leads to Arbitrary File Write and RCEEPSS 1.1%CVE-2023-21800HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2023-47862CRITICALA local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A speciEPSS 1.1%CVE-2025-48385HIGHGit alllows arbitrary file writes via bundle-uri parameter injectionEPSS 1.1%CVE-2026-73720HIGHAuthenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer APIEPSS 1.1%