Falhas do tipo CWE-915

138 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2022-4068HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenmsEPSS 34.0%CVE-2024-5452CRITICALRCE via Property/Class Pollution in lightning-ai/pytorch-lightningEPSS 26.5%CVE-2026-30822HIGHFlowise: Mass Assignment in `/api/v1/leads` EndpointEPSS 12.9%CVE-2026-50160CRITICALMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET OverwriteEPSS 8.6%CVE-2026-33453CRITICALApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionEPSS 6.2%CVE-2026-41277HIGHFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)EPSS 3.1%CVE-2022-43441HIGHA code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted JaEPSS 2.4%CVE-2021-32811HIGHRemote Code Execution via Script (Python) objects under Python 3EPSS 2.3%CVE-2021-32807MEDIUMRemote Code Execution via unsafe classes in otherwise permitted modulesEPSS 2.0%CVE-2021-21304HIGHPrototype Pollution in DynamooseEPSS 1.9%CVE-2026-40175MEDIUMAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainEPSS 1.9%CVE-2022-24802HIGHPrototype Pollution in deepmerge-tsEPSS 1.7%CVE-2021-21368MEDIUMPrototype poisoningEPSS 1.6%CVE-2022-2625—A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the abilityEPSS 1.5%CVE-2020-11066HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSEPSS 1.5%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.4%CVE-2021-21297HIGHPrototype Pollution in Node-RedEPSS 1.4%CVE-2026-27953HIGHormar has a Pydantic Validation Bypass via Kwargs Injection in Model ConstructorEPSS 1.2%CVE-2025-58367CRITICALDeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionEPSS 1.1%CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.0%