Falhas do tipo CWE-915

205 resultados

Modificação descontrolada de atributos dinâmicos de objetos

Ocorre quando a aplicação permite que usuários modifiquem atributos de objetos sem validação adequada, especialmente em linguagens que permitem criar propriedades dinamicamente (como Python, JavaScript, PHP). Um atacante consegue injetar ou sobrescrever atributos críticos — flags de admin, valores monetários, referências internas — alterando o comportamento da aplicação.

Exemplo

Um sistema em Python recebe JSON do usuário e faz `user.__dict__.update(request.json)` para popular dados de perfil. O atacante envia `{"is_admin": true}` e ganha privilégios sem autorização, porque nenhuma validação protege qual atributo pode ser modificado.

Como mitigar

Use listas explícitas de propriedades permitidas (whitelist) para update de objetos. Separe dados de entrada (DTO/schema) de modelos internos, mapeando apenas campos seguros. Nunca faça merge direto de entrada de usuário em atributos de objetos críticos.

CVE-2026-104908HIGHMISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingEPSS 0.3%CVE-2026-106550HIGHCVE-2026-106550EPSS 0.3%CVE-2025-13081MEDIUMDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-006EPSS 0.3%CVE-2026-34179CRITICALUpdate of type field in restricted TLS certificate allows privilege escalation to cluster adminEPSS 0.3%CVE-2026-103235HIGHMISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsEPSS 0.3%CVE-2026-46441HIGHFlowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.3%CVE-2026-116216MEDIUMMacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass AssignmentEPSS 0.3%CVE-2026-40486MEDIUMKimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rateEPSS 0.3%CVE-2026-112295MEDIUMFlyCms through commit edfdf724 Mass Assignment via /ucenter/account_updateEPSS 0.3%CVE-2026-42861HIGHFlowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource ReassignmentEPSS 0.3%CVE-2026-31815MEDIUMdjango-unicorn affected by component state manipulation via unvalidated attribute accessEPSS 0.3%CVE-2025-52656HIGHHCL MyXalytics product is affected by Mass Assignment vulnerabilityEPSS 0.3%CVE-2026-115933CRITICALForged signed tokens let any registered user take over other users and organizationsEPSS 0.2%CVE-2026-103918MEDIUM@orpc/zod: Prototype injection in smart coercionEPSS 0.2%CVE-2025-49597LOWhandcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code ExecutionEPSS 0.2%CVE-2026-5248MEDIUMgougucms User Registration Login.php reg_submit dynamically-determined object attributesEPSS 0.2%CVE-2026-5251MEDIUMz-9527 admin User Update Endpoint user.js dynamically-determined object attributesEPSS 0.2%CVE-2026-114573HIGHMonster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253EPSS 0.2%CVE-2025-61781HIGHGraphQL IDOR allows authenticated user to delete workspace content of other usersEPSS 0.2%CVE-2026-21886MEDIUMOpenCTI's GraphQL Mutations Allow Deletion of Unrelated EntitiesEPSS 0.2%