Falhas do tipo CWE-942

149 resultados

Política de segurança cross-domain permissiva com domínios não confiáveis

Ocorre quando uma aplicação web configura mecanismos de controle de acesso cross-domain (CORS, postMessage, etc.) de forma muito aberta, permitindo que domínios não confiáveis ou controlados por atacantes acessem recursos sensíveis. Isso quebra o isolamento entre origens e expõe dados ou funcionalidades que deveriam ser protegidas.

Exemplo

Um servidor configurando Access-Control-Allow-Origin: * em endpoints que retornam dados de usuário, ou aceitando comunicação postMessage de qualquer origem sem validar o remetente. Um site malicioso pode então executar JavaScript que rouba tokens, credenciais ou informações privadas do usuário.

Como mitigar

Especifique explicitamente os domínios permitidos em CORS (nunca use wildcard em produção com dados sensíveis). Valide a origem nas requisições cross-domain e implemente verificações de token/sessão robustas. Para postMessage, sempre validate event.origin antes de processar a mensagem.

CVE-2026-56076HIGHPraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI EndpointEPSS 0.6%CVE-2023-46098HIGHA vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, EPSS 0.6%CVE-2021-34435—In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the EPSS 0.6%CVE-2021-27786MEDIUMHCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin TrustedEPSS 0.6%CVE-2026-84176MEDIUMApache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionEPSS 0.6%CVE-2026-28792CRITICALCross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMSEPSS 0.6%CVE-2024-53276MEDIUMGHSL-2024-092: Open CORS policy in home-galleryEPSS 0.6%CVE-2026-82291HIGHHeyForm Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.6%CVE-2024-49763HIGHPlexRipper allows API leak due to open CORS policyEPSS 0.5%CVE-2022-34366MEDIUM Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticatedEPSS 0.5%CVE-2026-82287HIGHRybbit Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.5%CVE-2026-34449CRITICALSiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet InjectionEPSS 0.5%CVE-2025-43392MEDIUMThe issue was addressed with improved handling of caches. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPaEPSS 0.5%CVE-2026-65310HIGHMissing authentication and permissive CORS policyEPSS 0.5%CVE-2025-43480HIGHThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visEPSS 0.5%CVE-2024-37131HIGHSCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. A remote unauthenticated EPSS 0.5%CVE-2024-45642MEDIUMIBM Security ReaQta information disclosureEPSS 0.5%CVE-2023-23464HIGHMedia CP Media Control Panel – Information DisclosureEPSS 0.5%CVE-2026-89058HIGHResteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configEPSS 0.5%CVE-2026-68517MEDIUMGlances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the WildcardEPSS 0.5%