Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-21946HIGHIncorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalatiEPSS 0.2%CVE-2024-47014HIGHAndroid before 2024-10-05 on Google Pixel devices allows privilege escalation in the ABL component, A-330537292.EPSS 0.2%CVE-2023-32399—The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS VenEPSS 0.2%CVE-2024-21945HIGHIncorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege eEPSS 0.2%CVE-2021-0093MEDIUMIncorrect default permissions in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable a denial of serEPSS 0.2%CVE-2025-15333MEDIUMTanium addressed an information disclosure vulnerability in Threat Response.EPSS 0.2%CVE-2023-28192MEDIUMA permissions issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur EPSS 0.2%CVE-2023-42133MEDIUMPAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with EPSS 0.2%CVE-2024-38499HIGHImproper Privilege Management Vulnerability in CA Client Automation 14.5EPSS 0.2%CVE-2026-87886HIGHLocal privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (LiEPSS 0.2%KEVCVE-2020-13599LOWSecurity problem with settings and littlefsEPSS 0.2%CVE-2021-3917—A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. TEPSS 0.2%CVE-2025-54990MEDIUMXWiki AdminTools application doesn't set permissions on the AdminTools spaceEPSS 0.2%CVE-2025-68825HIGHHCL Hive is affected by incorrect default permissionsEPSS 0.2%CVE-2024-35139MEDIUMIBM Security Access Manager Docker information disclosureEPSS 0.2%CVE-2024-24828MEDIUMLocal Privilege Escalation in execuatables bundled by pkgEPSS 0.2%CVE-2023-50975HIGHThe TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsREPSS 0.2%CVE-2024-21939HIGHIncorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieEPSS 0.2%CVE-2025-32803MEDIUMInsecure file permissions can result in confidential information leakageEPSS 0.2%CVE-2024-52867HIGHguix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata EPSS 0.2%