Weaknesses of type CWE-1021

199 results

Implementação inadequada de mecanismo de segurança

Ocorre quando um desenvolvedor implementa um controle de segurança (autenticação, criptografia, validação, etc.) de forma incorreta ou incompleta, deixando brechas no mecanismo pretendido. A lógica pode estar presente, mas falha na prática porque não cobre todos os casos, usa configurações fracas ou não segue padrões estabelecidos.

Example

Uma aplicação implementa autenticação de dois fatores, mas aceita qualquer código OTP com mais de 4 dígitos sem validar se é realmente o esperado; ou usa MD5 para hash de senhas porque 'é rápido'. O mecanismo existe, mas não funciona corretamente.

How to mitigate

Use bibliotecas e frameworks de segurança consolidados em vez de reinventar a roda; revise implementações críticas (auth, crypto, validação) contra padrões da indústria (OWASP, NIST); execute testes de segurança específicos e code review com foco em lógica de controles, não apenas sintaxe.

CVE-2019-7393—A UI redress vulnerability in the administrative user interface of CA Technologies CA Strong Authentication 9.0.x, 8.2.x, 8.1.x, 8.0.x, 7.1.EPSS 2.3%CVE-2022-28889—Clickjacking in the web consoleEPSS 1.8%CVE-2022-1803HIGHImproper Restriction of Rendered UI Layers or Frames in polonel/trudeskEPSS 1.6%CVE-2021-3799MEDIUMImproper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-adminEPSS 1.6%CVE-2023-1362HIGHImproper Restriction of Rendered UI Layers or Frames in unilogies/bumsysEPSS 1.4%CVE-2022-46695MEDIUMA spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2,EPSS 1.3%CVE-2021-3660—Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via anotEPSS 1.3%CVE-2022-42799MEDIUMThe issue was addressed with improved UI handling. This issue is fixed in tvOS 16.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 anEPSS 1.2%CVE-2022-2179MEDIUMICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or FramesEPSS 1.1%CVE-2021-3731MEDIUMImproper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbEPSS 1.1%CVE-2020-28218—A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would aEPSS 1.1%CVE-2017-16775HIGHImproper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote atEPSS 1.1%CVE-2022-3167CRITICALImproper Restriction of Rendered UI Layers or Frames in ikus060/rdiffwebEPSS 1.0%CVE-2023-41897HIGHLack of XFO header allows clickjacking in Home Assistant CoreEPSS 0.9%CVE-2022-22807—A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the producEPSS 0.9%CVE-2021-35237MEDIUMClickjacking VulnerabilityEPSS 0.9%CVE-2024-26167MEDIUMMicrosoft Edge for Android Spoofing VulnerabilityEPSS 0.9%CVE-2022-24733MEDIUMImproper Restriction of Rendered UI Layers or Frames in SyliusEPSS 0.9%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.8%CVE-2020-15793—A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header whichEPSS 0.7%