Falhas do tipo CWE-862

7.175 resultados

Falha de verificação de autorização

A aplicação não valida se o usuário tem permissão para acessar um recurso ou executar uma ação específica. O código presume que quem chegou até ali já é confiável, pulando a checagem de privilégios. Qualquer atacante que consiga se autenticar (ou nem isso) pode fazer operações que deveria estar proibido.

Exemplo

Um admin painel que verifica login, mas depois deixa qualquer usuário logado deletar outros perfis acessando /admin/delete-user/123 diretamente. A autenticação existe, a autorização não.

Como mitigar

Implemente verificações de autorização (ACL, RBAC ou atributo-based) antes de cada operação sensível: confirme se o usuário tem a role ou permissão necessária. Não confie em autenticação alone — é login que prova quem você é, autorização que prova o que você pode fazer.

CVE-2022-47474MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47471MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47332MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-47450MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-47330MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-47479MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47475MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-48242MEDIUMIn telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execuEPSS 0.1%CVE-2022-47478MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-47333MEDIUMIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.EPSS 0.1%CVE-2022-48370MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional executioEPSS 0.1%CVE-2022-47476MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-48371MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional executioEPSS 0.1%CVE-2022-47477MEDIUMIn telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privEPSS 0.1%CVE-2022-20450HIGHIn restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission cEPSS 0.1%CVE-2023-20959HIGHIn AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead toEPSS 0.1%CVE-2022-47490MEDIUMIn soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privEPSS 0.1%CVE-2022-48375MEDIUMIn contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution pEPSS 0.1%CVE-2023-21021HIGHIn isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settingEPSS 0.1%CVE-2022-48379MEDIUMIn dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution priEPSS 0.1%