Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-25605MEDIUMThe Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack EPSS 0.5%CVE-2024-34223MEDIUMInsecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approveEPSS 0.5%CVE-2024-30204LOWIn Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.EPSS 0.5%CVE-2023-30281HIGHInsecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store CommEPSS 0.5%CVE-2022-30355CRITICALOvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId anEPSS 0.5%CVE-2024-48822HIGHPrivilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to esEPSS 0.5%CVE-2022-44554HIGHThe power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of EPSS 0.5%CVE-2024-57548CRITICALCMSimple 5.16 allows the user to edit log.php file via print page.EPSS 0.5%CVE-2025-8031CRITICALIncorrect URL stripping in CSP reportsEPSS 0.5%CVE-2024-51051CRITICALAVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account.EPSS 0.5%CVE-2020-13549HIGHAn exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directoryEPSS 0.5%CVE-2024-6640MEDIUMpf incorrectly matches different ICMPv6 states in the state tableEPSS 0.5%CVE-2023-54366HIGHSurrealDB before 1.0.1 Insecure Default Table PermissionsEPSS 0.5%CVE-2023-23976HIGHWordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price ChangeEPSS 0.5%CVE-2026-17497HIGHNoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/pythonEPSS 0.5%CVE-2026-33590HIGHInsecure default permissions in Portainer CEEPSS 0.5%CVE-2023-41718HIGHWhen a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when haEPSS 0.5%CVE-2014-7210CRITICALpdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scrEPSS 0.4%CVE-2023-1907HIGHPgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionEPSS 0.4%CVE-2024-50657MEDIUMAn issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specEPSS 0.4%