Falhas do tipo CWE-915

165 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-17598MEDIUMNexus Repository 3 - Improper Input Validation in Scheduled Task ConfigurationEPSS 0.3%CVE-2025-52656HIGHHCL MyXalytics product is affected by Mass Assignment vulnerabilityEPSS 0.3%CVE-2025-49597LOWhandcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code ExecutionEPSS 0.2%CVE-2026-84430MEDIUMgouguoa edit_personal Endpoint Index.php update dynamically-determined object attributesEPSS 0.2%CVE-2026-5251MEDIUMz-9527 admin User Update Endpoint user.js dynamically-determined object attributesEPSS 0.2%CVE-2025-61781HIGHGraphQL IDOR allows authenticated user to delete workspace content of other usersEPSS 0.2%CVE-2026-5248MEDIUMgougucms User Registration Login.php reg_submit dynamically-determined object attributesEPSS 0.2%CVE-2026-45058CRITICALelecterm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmarkEPSS 0.2%CVE-2026-85408MEDIUMEleveo Quality Management Conversation events dynamically-determined object attributesEPSS 0.2%CVE-2026-23522LOWLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionEPSS 0.2%CVE-2026-21886MEDIUMOpenCTI's GraphQL Mutations Allow Deletion of Unrelated EntitiesEPSS 0.2%CVE-2026-15083MEDIUMECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074EPSS 0.2%CVE-2026-72655MEDIUMImproperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data ModificationEPSS 0.2%CVE-2025-14341HIGHInput Data Manipulation in DivvyDrive Information Technologies' DivvyDriveEPSS 0.2%CVE-2026-31251HIGHCosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in EPSS 0.2%CVE-2026-31815MEDIUMdjango-unicorn affected by component state manipulation via unvalidated attribute accessEPSS 0.2%CVE-2026-28219LOWPrivilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global BannersEPSS 0.2%CVE-2026-42862HIGHFlowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.2%CVE-2026-47850MEDIUMSpring Data REST allows mutation of the version property of immutable aggregates via PUTEPSS 0.2%CVE-2026-42540MEDIUMIRIS has a Mass Assignment issueEPSS 0.2%