Falhas do tipo CWE-942

134 resultados

Política de segurança cross-domain permissiva com domínios não confiáveis

Ocorre quando uma aplicação web configura mecanismos de controle de acesso cross-domain (CORS, postMessage, etc.) de forma muito aberta, permitindo que domínios não confiáveis ou controlados por atacantes acessem recursos sensíveis. Isso quebra o isolamento entre origens e expõe dados ou funcionalidades que deveriam ser protegidas.

Exemplo

Um servidor configurando Access-Control-Allow-Origin: * em endpoints que retornam dados de usuário, ou aceitando comunicação postMessage de qualquer origem sem validar o remetente. Um site malicioso pode então executar JavaScript que rouba tokens, credenciais ou informações privadas do usuário.

Como mitigar

Especifique explicitamente os domínios permitidos em CORS (nunca use wildcard em produção com dados sensíveis). Valide a origem nas requisições cross-domain e implemente verificações de token/sessão robustas. Para postMessage, sempre validate event.origin antes de processar a mensagem.

CVE-2025-55462MEDIUMA CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in tEPSS 0.4%CVE-2026-8948CRITICALSame-origin policy bypass in the DOM: Networking componentEPSS 0.4%CVE-2026-32617HIGHAnythingLLM Permissable CORS policyEPSS 0.4%CVE-2026-34839HIGHGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORSEPSS 0.4%CVE-2026-46608HIGHGlances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)EPSS 0.4%CVE-2026-25478HIGHLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originsEPSS 0.4%CVE-2026-34227MEDIUMSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceEPSS 0.4%CVE-2023-25603MEDIUMA permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.EPSS 0.4%CVE-2026-44895CRITICALGitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab toolsEPSS 0.4%CVE-2023-2360LOWSensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) beforEPSS 0.4%CVE-2026-33010HIGHmcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory TheftEPSS 0.4%CVE-2023-23128MEDIUMConnectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have EPSS 0.4%CVE-2023-45213MEDIUM Westermo Lynx Permissive Cross-domain Policy with Untrusted DomainsEPSS 0.4%CVE-2025-30354HIGHBruno ignores Safe-Mode in Asserts expressionsEPSS 0.4%CVE-2026-46409CRITICALOpenYak local API: unauthenticated CSRF chain leads to Remote Code ExecutionEPSS 0.4%CVE-2024-22348MEDIUMIBM UrbanCode Velocity cross-origin resource sharingEPSS 0.4%CVE-2026-12962MEDIUMA Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash byEPSS 0.4%CVE-2026-34200HIGHNhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network PortEPSS 0.4%CVE-2025-41366MEDIUMCORS vulnerability in IDF and ZLFEPSS 0.4%CVE-2025-9292LOWPermissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud ControllersEPSS 0.4%