Falhas do tipo CWE-915

205 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.1%CVE-2022-31106HIGHPrototype Pollution in underscore.deepEPSS 1.1%CVE-2026-78416HIGHAuthenticated RCE via `condition.config` JSON cleanse bypassEPSS 1.0%CVE-2026-59721HIGHHoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injectionEPSS 1.0%CVE-2026-29063HIGHImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableEPSS 1.0%CVE-2024-55638CRITICALDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-008EPSS 1.0%CVE-2024-3283HIGHPrivilege Escalation via Mass Assignment in mintplex-labs/anything-llmEPSS 0.9%CVE-2024-55636CRITICALDrupal core - Less critical - Gadget chain - SA-CORE-2024-006EPSS 0.9%CVE-2024-57708MEDIUMAn issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.EPSS 0.9%CVE-2026-46625HIGHJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionEPSS 0.9%CVE-2026-42033HIGHAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingEPSS 0.9%CVE-2023-32079HIGHNetmaker Privilige Escalation VulnerabilityEPSS 0.9%CVE-2026-33228HIGHflatted: Prototype Pollution via parse()EPSS 0.9%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 0.9%CVE-2026-5708HIGHImproper Control of User-Modifiable Attributes in RES CreateSession APIEPSS 0.9%CVE-2024-55637CRITICALDrupal core - Moderately critical - Gadget chain - SA-CORE-2024-007EPSS 0.8%CVE-2025-69690CRITICALNetgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the EPSS 0.8%CVE-2026-72778HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configEPSS 0.8%CVE-2026-42264HIGHAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingEPSS 0.8%CVE-2026-84645HIGHIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confiEPSS 0.8%