Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-6238HIGHpgAdmin 4 Installation Directory permission issueEPSS 0.2%CVE-2024-27149HIGHLocal Privilege Escalation and Remote Code Execution using insecure LD_PRELOADEPSS 0.2%CVE-2024-27148HIGHLocal Privilege Escalation and Remote Code Execution using insecure PATHEPSS 0.2%CVE-2025-44643HIGHCertain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The settingEPSS 0.2%CVE-2023-32405—A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. AnEPSS 0.2%CVE-2020-11921HIGHAn issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing BEPSS 0.2%CVE-2022-37018HIGHA potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and codEPSS 0.2%CVE-2026-48190LOWIncorrect handling of permissions in External Interface Config Item List moduleEPSS 0.2%CVE-2026-48191LOWWrong Permission Handling in Document Search Article Meta FiltersEPSS 0.2%CVE-2024-6974HIGHCato Networks Windows SDP Client Local Privilege Escalation via self-upgradeEPSS 0.2%CVE-2024-29967MEDIUMIn Brocade SANnav before v2.31 and v2.3.0a, it was observed that Docker instances inside the appliance have insecure mount pointsEPSS 0.2%CVE-2022-20456HIGHIn AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This cEPSS 0.2%CVE-2024-9191HIGHThe Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables aEPSS 0.2%CVE-2024-6122MEDIUMIncorrect Default Directory Permissions for NI SystemLink Redis ServiceEPSS 0.2%CVE-2026-36742MEDIUMHiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. The UART bootloader is accessible when battery is disconnected (hidden/debug mode)EPSS 0.2%CVE-2025-10918HIGHInsecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write EPSS 0.2%CVE-2023-49721MEDIUMAn insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.EPSS 0.2%CVE-2023-32404—This issue was addressed with improved entitlements. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. An apEPSS 0.2%CVE-2021-0235HIGHJunos OS: SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series: In a multi-tenant environment, a tenant host administrator may configure logical firewall isolation affecting other tenant networksEPSS 0.2%CVE-2021-0246HIGHJunos OS: SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3: In a multi-tenant environment, a tenant host administrator may be able to jailbreak out of their network impacting other tenant networks or gather information from other networks.EPSS 0.2%