Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-43791HIGHRequestStore has Incorrect Default PermissionsEPSS 0.2%CVE-2025-5963MEDIUMTCC Bypass via Dylib Injection in PostboxEPSS 0.2%CVE-2022-42464MEDIUMKernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...EPSS 0.2%CVE-2022-4569HIGHA local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with loEPSS 0.2%CVE-2023-24460HIGHIncorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially EPSS 0.2%CVE-2025-43350LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.1 and iPadOS 26.1. An attacker may be able to EPSS 0.2%CVE-2023-38410—The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to eleEPSS 0.2%CVE-2024-0245MEDIUMTask Hijacking in hamza417/inureEPSS 0.2%CVE-2025-24790MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissionsEPSS 0.2%CVE-2024-7587HIGHInformation Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32EPSS 0.2%CVE-2021-3722MEDIUMA denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be wEPSS 0.2%CVE-2022-30747MEDIUMPendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via impliEPSS 0.2%CVE-2025-57848MEDIUMContainer-native-virtualization: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2022-26855MEDIUMDell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentiEPSS 0.2%CVE-2022-1038HIGHA potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommEPSS 0.2%CVE-2021-44470MEDIUMIncorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentiEPSS 0.2%CVE-2022-27500MEDIUMIncorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enEPSS 0.2%CVE-2023-3440HIGHFile and Directory Permission Vulnerability in JP1/Performance ManagementEPSS 0.2%CVE-2025-62577HIGHETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to EPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%