Weaknesses of type CWE-915

138 results

Modificação descontrolada de atributos de objetos determinados dinamicamente

A aplicação permite que um atacante modifique atributos de um objeto através de entrada do usuário sem validação adequada, porque o nome ou referência do atributo é construído dinamicamente a partir de dados não confiáveis. Isso pode levar a lógica de negócio comprometida, bypass de controles de acesso ou alteração de dados sensíveis.

Example

Um sistema web usa reflection ou mapeamento automático para atribuir parâmetros HTTP diretamente a propriedades de um objeto modelo (ex: `user.__proto__.isAdmin = true`). Um atacante envia `isAdmin=true` ou manipula o protótipo do objeto, escalando seus privilégios sem autenticação apropriada.

How to mitigate

Implemente um whitelist explícito de atributos que podem ser modificados dinamicamente, nunca permita entrada do usuário determinar diretamente qual propriedade será alterada. Desabilite reflection ou mapeamento automático em camadas sensíveis, e valide rigorosamente tipos e valores antes de qualquer atribuição.

CVE-2022-4068HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenmsEPSS 34.0%CVE-2024-5452CRITICALRCE via Property/Class Pollution in lightning-ai/pytorch-lightningEPSS 26.5%CVE-2026-30822HIGHFlowise: Mass Assignment in `/api/v1/leads` EndpointEPSS 12.9%CVE-2026-50160CRITICALMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET OverwriteEPSS 8.6%CVE-2026-33453CRITICALApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionEPSS 6.2%CVE-2026-41277HIGHFlowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR)EPSS 3.1%CVE-2022-43441HIGHA code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted JaEPSS 2.4%CVE-2021-32811HIGHRemote Code Execution via Script (Python) objects under Python 3EPSS 2.3%CVE-2021-32807MEDIUMRemote Code Execution via unsafe classes in otherwise permitted modulesEPSS 2.0%CVE-2021-21304HIGHPrototype Pollution in DynamooseEPSS 1.9%CVE-2026-40175MEDIUMAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainEPSS 1.9%CVE-2022-24802HIGHPrototype Pollution in deepmerge-tsEPSS 1.7%CVE-2021-21368MEDIUMPrototype poisoningEPSS 1.6%CVE-2022-2625—A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the abilityEPSS 1.5%CVE-2020-11066HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSEPSS 1.5%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.4%CVE-2021-21297HIGHPrototype Pollution in Node-RedEPSS 1.4%CVE-2026-27953HIGHormar has a Pydantic Validation Bypass via Kwargs Injection in Model ConstructorEPSS 1.2%CVE-2025-58367CRITICALDeepDiff is vulnerable to DoS and Remote Code Execution via Delta class pollutionEPSS 1.1%CVE-2026-44494HIGHAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`EPSS 1.0%