Weaknesses of type CWE-275

57 results

Problemas de Permissões

Fraqueza genérica que abrange falhas no controle de acesso e na gestão de permissões de arquivos, diretórios ou recursos do sistema. Quando permissões estão mal configuradas ou ausentes, usuários não autorizados conseguem ler, modificar ou executar arquivos e funcionalidades que deveriam estar protegidos.

Example

Um aplicativo salva arquivos de configuração sensíveis (senhas, tokens) no diretório /tmp com permissões 644 (leitura para todos), permitindo que qualquer usuário do sistema leia dados confidenciais. Ou uma API deixa um endpoint administrativo acessível sem verificar privilégios do usuário.

How to mitigate

Defina permissões de arquivo com o princípio do menor privilégio (geralmente 600 ou 640 para arquivos sensíveis, 700 para diretórios). No código, implemente controle de acesso baseado em roles/permissões antes de qualquer operação crítica, validando contexto do usuário a cada requisição.

CVE-2019-1618HIGHCisco Nexus 9000 Series Switches Standalone NX-OS Mode Tetration Analytics Agent Arbitrary Code Execution VulnerabilityEPSS 0.4%CVE-2023-39399CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2023-39398CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2014-1422MEDIUMLocation service uses cached authorization even after revocationEPSS 0.4%CVE-2020-8471HIGHABB Central Licensing System - Weak File PermissionsEPSS 0.4%CVE-2026-75978MEDIUMxianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permissionEPSS 0.4%CVE-2022-25153HIGHITarian - Local privilege escalation in Endpoint Manager agent on WindowsEPSS 0.3%CVE-2024-11485MEDIUMCode4Berry Decoration Management System User userregister.php permissionEPSS 0.3%CVE-2024-11486MEDIUMCode4Berry Decoration Management System User Permission user_permission.phpEPSS 0.3%CVE-2020-6022—Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.EPSS 0.3%CVE-2020-8474HIGHABB System 800xA Weak Registry PermissionsEPSS 0.3%CVE-2023-37238—Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitaEPSS 0.3%CVE-2021-22566MEDIUMIncorrect mapping of Executable bits in Fuchsia KernelEPSS 0.3%CVE-2018-0392—A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulEPSS 0.3%CVE-2018-0449MEDIUMCisco Jabber Client Framework Insecure Directory Permissions VulnerabilityEPSS 0.3%CVE-2019-12622MEDIUMCisco RoomOS Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2019-15962MEDIUMCisco TelePresence Collaboration Endpoint Software Arbitrary File Write VulnerabilityEPSS 0.3%CVE-2026-105165MEDIUMdevopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignmentEPSS 0.2%CVE-2021-22571MEDIUMInformation Leak in SA360-webquery-bigquery through read on /tmpEPSS 0.2%CVE-2025-54624MEDIUMUnexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.2%