Falhas do tipo CWE-915

165 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-71473HIGHAcm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spokeEPSS 0.3%CVE-2026-63428MEDIUMHeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field setEPSS 0.3%CVE-2026-46478HIGHFlowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverEPSS 0.3%CVE-2026-45687HIGHRocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessageEPSS 0.3%CVE-2025-66451MEDIUMLibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission ChangesEPSS 0.3%CVE-2026-46475HIGHFlowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverEPSS 0.3%CVE-2026-46476HIGHFlowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverEPSS 0.3%CVE-2026-46480HIGHFlowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverEPSS 0.3%CVE-2026-46477HIGHFlowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverEPSS 0.3%CVE-2026-46479HIGHFlowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverEPSS 0.3%CVE-2026-63102MEDIUMrConfig Core < 8.2.8 Privilege Escalation via Users API role fieldEPSS 0.3%CVE-2026-41267HIGHFlowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization AssociationEPSS 0.3%CVE-2026-59284MEDIUMSpring Cloud Commons no allow list for writable env actuator endpointEPSS 0.3%CVE-2026-24140LOWMyTube has Mass Assignment via Settings ManagementEPSS 0.3%CVE-2026-28781HIGHCraft Affected by Entries Authorship Spoofing via Mass AssignmentEPSS 0.3%CVE-2026-92217MEDIUMa2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributesEPSS 0.3%CVE-2026-12436HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in GitLabEPSS 0.3%CVE-2026-59888MEDIUMjackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyEPSS 0.3%CVE-2026-45396MEDIUMOpen WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data ManipulationEPSS 0.3%CVE-2026-32742MEDIUMParse Server session creation endpoint allows overwriting server-generated session fieldsEPSS 0.3%