Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-21960HIGHIncorrect default permissions in the AMD Optimizing CPU Libraries (AOCL) installation directory could allow an attacker to achieve privilegeEPSS 0.2%CVE-2024-13206HIGHREVE Antivirus reveinstall default permissionEPSS 0.2%CVE-2024-32942MEDIUMIncorrect default permissions for some Intel(R) DSA installer for Windows before version 24.2.19.5 may allow an authenticated user to potentEPSS 0.2%CVE-2026-34450MEDIUMClaude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory ToolEPSS 0.2%CVE-2023-42668MEDIUMIncorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X ChiEPSS 0.2%CVE-2023-42928HIGHThe issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be able to gain elevated prEPSS 0.2%CVE-2023-42433MEDIUMIncorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to EPSS 0.2%CVE-2024-4679HIGHFolder Permission Vulnerability in JP1/Extensible SNMP AgentEPSS 0.2%CVE-2022-20495HIGHIn getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility service due to a logic EPSS 0.2%CVE-2024-52783MEDIUMInsecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code viaEPSS 0.2%CVE-2024-22428HIGH Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unpriviEPSS 0.2%CVE-2025-54866LOWWazuh installation fails to protected authd.pass on WindowsEPSS 0.2%CVE-2024-21123LOWVulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily EPSS 0.2%CVE-2023-38294MEDIUMCertain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsiEPSS 0.2%CVE-2024-52926MEDIUMDelinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.EPSS 0.2%CVE-2023-28724HIGHNGINX Management Suite vulnerabilityEPSS 0.2%CVE-2022-36439MEDIUMAsusSoftwareManager.exe in ASUS System Control Interface on ASUS personal computers (running Windows) allows a local user to write into the EPSS 0.2%CVE-2022-42718HIGHIncorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to poteEPSS 0.2%CVE-2025-43442LOWA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.EPSS 0.2%CVE-2023-29162MEDIUMImproper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 maEPSS 0.2%