Weaknesses of type CWE-294

169 results

Exposição de informação sensível a usuário não autorizado

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves API) para alguém que não deveria ter acesso. Isso ocorre por falha de controle de acesso, logging inadequado, erro em configuração ou vazamento em comunicação desprotegida. O risco é direto: credenciais ou dados privados caem em mãos erradas.

Example

Um endpoint de API retorna o hash de senha do usuário na resposta JSON, ou um arquivo de configuração com credenciais de banco de dados fica acessível publicamente no repositório git, ou um log de erro exibe o token de autenticação completo na tela do usuário final.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC/ABAC); nunca exponha segredos em respostas HTTP, logs ou versionamento; use variáveis de ambiente para credenciais; valide e sanitize erros antes de retornar ao cliente; revise regularmente permissões de arquivos e endpoints.

CVE-2017-3191—D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A rEPSS 62.5%CVE-2023-49231CRITICALAn authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administraEPSS 42.9%CVE-2022-29593MEDIUMrelay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need EPSS 13.2%CVE-2022-22806—A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malEPSS 12.3%CVE-2017-6034CRITICALSchneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replayEPSS 5.2%CVE-2018-7790CRITICALAn Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firEPSS 2.5%CVE-2022-43704MEDIUMThe Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate usEPSS 1.9%CVE-2021-38296—Apache Spark Key Negotiation VulnerabilityEPSS 1.8%CVE-2018-17903—SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.EPSS 1.6%CVE-2018-17932—JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, whicEPSS 1.5%CVE-2018-19025—In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (FirmwareEPSS 1.5%CVE-2020-5261HIGHMissing Token Replay DetectionEPSS 1.5%CVE-2022-45789HIGHA CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the cEPSS 1.4%CVE-2018-1128—It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker haviEPSS 1.4%CVE-2019-18226—Honeywell equIP series and Performance series IP cameras and recorders, A vulnerability exists in the affected products where IP cameras andEPSS 1.4%CVE-2020-6972—In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay atEPSS 1.3%CVE-2023-2846HIGHAuthentication Bypass Vulnerability in MELSEC-F Series main moduleEPSS 1.3%CVE-2022-41541HIGHTP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and EPSS 1.1%CVE-2022-37011—A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All veEPSS 1.1%CVE-2022-29878HIGHA vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent duriEPSS 1.1%