Falhas do tipo CWE-942

149 resultados

Política de segurança cross-domain permissiva com domínios não confiáveis

Ocorre quando uma aplicação web configura mecanismos de controle de acesso cross-domain (CORS, postMessage, etc.) de forma muito aberta, permitindo que domínios não confiáveis ou controlados por atacantes acessem recursos sensíveis. Isso quebra o isolamento entre origens e expõe dados ou funcionalidades que deveriam ser protegidas.

Exemplo

Um servidor configurando Access-Control-Allow-Origin: * em endpoints que retornam dados de usuário, ou aceitando comunicação postMessage de qualquer origem sem validar o remetente. Um site malicioso pode então executar JavaScript que rouba tokens, credenciais ou informações privadas do usuário.

Como mitigar

Especifique explicitamente os domínios permitidos em CORS (nunca use wildcard em produção com dados sensíveis). Valide a origem nas requisições cross-domain e implemente verificações de token/sessão robustas. Para postMessage, sempre validate event.origin antes de processar a mensagem.

CVE-2023-50940MEDIUMIBM PowerSC cross-resource origin sharingEPSS 0.5%CVE-2026-8919HIGHPermissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by coEPSS 0.4%CVE-2026-12962MEDIUMA Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash byEPSS 0.4%CVE-2026-44895CRITICALGitLab MCP Server: SSE transport has no authentication and wildcard CORS, exposing all GitLab toolsEPSS 0.4%CVE-2026-90882HIGHReflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataEPSS 0.4%CVE-2026-25478HIGHLitestar has a CORS origin allowlist bypass due to unescaped regex metacharacters in allowed originsEPSS 0.4%CVE-2025-25264MEDIUMOverly Permissive CORS Policy in WAGO Device ManagerEPSS 0.4%CVE-2026-57957LOWPapermark 0.22.0 - CORS Misconfiguration in Viewer Upload EndpointEPSS 0.4%CVE-2023-37526MEDIUMHCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) VulnerabilityEPSS 0.4%CVE-2024-32862MEDIUMexacqVision CORSEPSS 0.4%CVE-2026-32617HIGHAnythingLLM Permissable CORS policyEPSS 0.4%CVE-2026-8948CRITICALSame-origin policy bypass in the DOM: Networking componentEPSS 0.4%CVE-2025-55462MEDIUMA CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in tEPSS 0.4%CVE-2026-85313MEDIUMApache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is SetEPSS 0.4%CVE-2026-34227MEDIUMSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceEPSS 0.4%CVE-2026-34839HIGHGlances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORSEPSS 0.4%CVE-2026-33010HIGHmcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory TheftEPSS 0.4%CVE-2026-46608HIGHGlances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)EPSS 0.4%CVE-2023-25603MEDIUMA permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.EPSS 0.4%CVE-2023-2360LOWSensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) beforEPSS 0.4%