Falhas do tipo CWE-915

205 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-12436HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabEPSS 0.5%CVE-2026-43925MEDIUMFOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code useEPSS 0.5%CVE-2026-71504HIGHDolibarr < 24.0.0 Members REST API Improper Authorization via Password ResetEPSS 0.5%CVE-2026-54351HIGHBudibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId OverrideEPSS 0.5%CVE-2025-9315MEDIUMUnauthenticated Device Registration Vulnerability in MXsecurity SeriesEPSS 0.5%CVE-2026-77470HIGHLychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST requestEPSS 0.5%CVE-2026-54516MEDIUMjackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsEPSS 0.4%CVE-2026-54515MEDIUMjackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesEPSS 0.4%CVE-2025-6107LOWcomfyanonymous comfyui utils.py set_attr dynamically-determined object attributesEPSS 0.4%CVE-2026-27125MEDIUMSvelte SSR attribute spreading includes inherited properties from prototype chainEPSS 0.4%CVE-2026-13244HIGHTealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064EPSS 0.4%CVE-2026-55810HIGHPlotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050EPSS 0.4%CVE-2026-55809HIGHFlag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049EPSS 0.4%CVE-2026-84430MEDIUMgouguoa edit_personal Endpoint Index.php update dynamically-determined object attributesEPSS 0.4%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.4%CVE-2026-50281HIGHCraft CMS: Mass assignment via id in newAttributes during bulk duplicate overwrites existing elementsEPSS 0.4%CVE-2026-61598HIGHClient mass-assignment of arbitrary view attributes via the default dj-model update_model handlerEPSS 0.4%CVE-2026-59284MEDIUMSpring Cloud Commons no allow list for writable env actuator endpointEPSS 0.4%CVE-2026-59888MEDIUMjackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyEPSS 0.4%CVE-2026-58255HIGHCronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401EPSS 0.4%