Falhas do tipo CWE-915

165 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-32640HIGH(SimpleEval) Objects (including modules) can leak dangerous modules through to direct access inside the sandbox.EPSS 0.5%CVE-2026-56679HIGH9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgradeEPSS 0.5%CVE-2026-58477HIGHSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP ParametersEPSS 0.5%CVE-2026-34406CRITICALAPTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit EndpointEPSS 0.5%CVE-2026-18617HIGHData-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator podEPSS 0.5%CVE-2025-24370CRITICALDjango-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication BypassEPSS 0.5%CVE-2026-27591CRITICALWinter: Privilege escalation by authenticated backend usersEPSS 0.5%CVE-2026-93752HIGHCSSOM through 0.5.0 Denial of Service via length PropertyEPSS 0.5%CVE-2022-48359—The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability mayEPSS 0.5%CVE-2026-43925MEDIUMFOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code useEPSS 0.5%CVE-2026-54351HIGHBudibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideEPSS 0.5%CVE-2025-15602HIGHSnipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege EscalationEPSS 0.5%CVE-2025-9315MEDIUMUnauthenticated Device Registration Vulnerability in MXsecurity SeriesEPSS 0.5%CVE-2026-69258HIGHFlowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APIEPSS 0.5%CVE-2026-54516MEDIUMjackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsEPSS 0.4%CVE-2026-72778HIGHCraft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.configEPSS 0.4%CVE-2025-6107LOWcomfyanonymous comfyui utils.py set_attr dynamically-determined object attributesEPSS 0.4%CVE-2026-13244HIGHTealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064EPSS 0.4%CVE-2026-55809HIGHFlag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049EPSS 0.4%CVE-2026-55810HIGHPlotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050EPSS 0.4%