Falhas do tipo CWE-942

134 resultados

Política de segurança cross-domain permissiva com domínios não confiáveis

Ocorre quando uma aplicação web configura mecanismos de controle de acesso cross-domain (CORS, postMessage, etc.) de forma muito aberta, permitindo que domínios não confiáveis ou controlados por atacantes acessem recursos sensíveis. Isso quebra o isolamento entre origens e expõe dados ou funcionalidades que deveriam ser protegidas.

Exemplo

Um servidor configurando Access-Control-Allow-Origin: * em endpoints que retornam dados de usuário, ou aceitando comunicação postMessage de qualquer origem sem validar o remetente. Um site malicioso pode então executar JavaScript que rouba tokens, credenciais ou informações privadas do usuário.

Como mitigar

Especifique explicitamente os domínios permitidos em CORS (nunca use wildcard em produção com dados sensíveis). Valide a origem nas requisições cross-domain e implemente verificações de token/sessão robustas. Para postMessage, sempre validate event.origin antes de processar a mensagem.

CVE-2025-4839LOWitwanger paicoding CrossUtil.java cross-domain policyEPSS 0.3%CVE-2025-25234HIGHOmnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious actor with network access to UAG may be able tEPSS 0.3%CVE-2025-61163CRITICALCohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the servEPSS 0.3%CVE-2026-82287HIGHRybbit Reflects Any Origin in CORS Responses While Allowing CredentialsEPSS 0.3%CVE-2026-70604HIGHElectron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsEPSS 0.3%CVE-2026-9739CRITICALVulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `alloweEPSS 0.3%CVE-2026-55110HIGHA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration EPSS 0.3%CVE-2026-63407HIGHGrav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API ResponsesEPSS 0.3%CVE-2026-12084MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsEPSS 0.3%CVE-2026-56458MEDIUMHCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsEPSS 0.3%CVE-2026-59148HIGHMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftEPSS 0.3%CVE-2026-5302MEDIUMPermissive Cross-domain Policy with Untrusted Domains in coolercontroldEPSS 0.3%CVE-2025-4542LOWFreeebird Hotel 酒店管理系统 API SessionInterceptor.java cross-domain policyEPSS 0.3%CVE-2025-13017HIGHSame-origin policy bypass in the DOM: Notifications componentEPSS 0.3%CVE-2025-13019HIGHSame-origin policy bypass in the DOM: Workers componentEPSS 0.3%CVE-2026-30924CRITICALqui CORS Misconfiguration: Arbitrary Origins TrustedEPSS 0.3%CVE-2026-74881HIGHopenssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard OriginsEPSS 0.3%CVE-2026-10056HIGHCORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin requestEPSS 0.2%CVE-2026-27579HIGHCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data ExposureEPSS 0.2%CVE-2026-18676MEDIUMKong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost adminEPSS 0.2%