Falhas do tipo CWE-424

34 resultados

Proteção inadequada de caminhos alternativos

O software protege um caminho ou recurso principal, mas deixa desprotegido um caminho alternativo que leva ao mesmo destino. Um atacante contorna as validações da rota esperada usando uma entrada equivalente que não foi validada adequadamente.

Exemplo

Uma aplicação bloqueia acesso a '/admin/painel' com autenticação, mas não valida '/admin/../painel' ou a codificação alternativa da URL. O atacante usa o caminho alternativo e bypassa a proteção porque a validação foi implementada apenas para o caminho canônico.

Como mitigar

Normalize todas as entradas (URLs, caminhos de arquivo, paths) antes de validar, removendo caracteres especiais e resolvendo referências relativas (/../). Aplique as mesmas regras de autenticação e autorização para qualquer variação de acesso ao recurso sensível, não apenas a forma esperada.

CVE-2024-58136CRITICALYii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited iEPSS 84.8%KEVCVE-2025-48827CRITICALvBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when runningEPSS 77.4%CVE-2025-48828CRITICALCertain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By cEPSS 60.3%CVE-2019-18997MEDIUMPB610 HMISimulator provides interface with access to arbitrary filesEPSS 1.5%CVE-2023-20272MEDIUMA vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplEPSS 0.9%CVE-2021-3793MEDIUMAn improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated EPSS 0.7%CVE-2024-8311MEDIUMImproper Protection of Alternate Path in GitLabEPSS 0.6%CVE-2026-4913MEDIUMImproper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access whenEPSS 0.6%CVE-2024-3927MEDIUMElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email BypassEPSS 0.4%CVE-2019-18996HIGHABB PB610 HMIStudio accepts malicious DLL file in an applicationEPSS 0.4%CVE-2026-66756MEDIUMApache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseEPSS 0.3%CVE-2026-54423HIGHIn OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use tEPSS 0.3%CVE-2025-68939HIGHGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.EPSS 0.3%CVE-2022-1742MEDIUM2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424EPSS 0.3%CVE-2024-3460HIGHIn KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing EPSS 0.3%CVE-2025-58079MEDIUMImproper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create maliciousEPSS 0.3%CVE-2024-3459HIGHKioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened EPSS 0.3%CVE-2025-0113MEDIUMCortex XDR Broker VM: Unauthorized Access to Broker VM Docker ContainersEPSS 0.3%CVE-2025-46654MEDIUMCodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploadiEPSS 0.2%CVE-2025-46655MEDIUMCodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be byEPSS 0.2%