Weaknesses of type CWE-275

54 results

Problemas de Permissões

Fraqueza genérica que abrange falhas no controle de acesso e na gestão de permissões de arquivos, diretórios ou recursos do sistema. Quando permissões estão mal configuradas ou ausentes, usuários não autorizados conseguem ler, modificar ou executar arquivos e funcionalidades que deveriam estar protegidos.

Example

Um aplicativo salva arquivos de configuração sensíveis (senhas, tokens) no diretório /tmp com permissões 644 (leitura para todos), permitindo que qualquer usuário do sistema leia dados confidenciais. Ou uma API deixa um endpoint administrativo acessível sem verificar privilégios do usuário.

How to mitigate

Defina permissões de arquivo com o princípio do menor privilégio (geralmente 600 ou 640 para arquivos sensíveis, 700 para diretórios). No código, implemente controle de acesso baseado em roles/permissões antes de qualquer operação crítica, validando contexto do usuário a cada requisição.

CVE-2023-39398CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2023-39399CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2020-8471HIGHABB Central Licensing System - Weak File PermissionsEPSS 0.4%CVE-2014-1422MEDIUMLocation service uses cached authorization even after revocationEPSS 0.4%CVE-2026-19376MEDIUMUasoft Badaso File API api.php class permissionEPSS 0.4%CVE-2022-25153HIGHITarian - Local privilege escalation in Endpoint Manager agent on WindowsEPSS 0.3%CVE-2024-11485MEDIUMCode4Berry Decoration Management System User userregister.php permissionEPSS 0.3%CVE-2024-11486MEDIUMCode4Berry Decoration Management System User Permission user_permission.phpEPSS 0.3%CVE-2020-6022—Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.EPSS 0.3%CVE-2020-8474HIGHABB System 800xA Weak Registry PermissionsEPSS 0.3%CVE-2023-37238—Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitaEPSS 0.3%CVE-2021-22566MEDIUMIncorrect mapping of Executable bits in Fuchsia KernelEPSS 0.3%CVE-2018-0392—A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulEPSS 0.3%CVE-2018-0449MEDIUMCisco Jabber Client Framework Insecure Directory Permissions VulnerabilityEPSS 0.3%CVE-2026-75978MEDIUMxianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permissionEPSS 0.3%CVE-2019-12622MEDIUMCisco RoomOS Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2019-15962MEDIUMCisco TelePresence Collaboration Endpoint Software Arbitrary File Write VulnerabilityEPSS 0.3%CVE-2021-22571MEDIUMInformation Leak in SA360-webquery-bigquery through read on /tmpEPSS 0.2%CVE-2022-22251HIGHcSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privilegesEPSS 0.2%CVE-2025-54624MEDIUMUnexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.2%