Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2023-22440MEDIUMIncorrect default permissions in the Intel(R) SCS Add-on software installer for Microsoft SCCM all versions may allow an authenticated user EPSS 0.1%CVE-2022-30338MEDIUMIncorrect default permissions in the Intel(R) VROC software before version 7.7.6.1003 may allow an authenticated user to potentially enable EPSS 0.1%CVE-2023-46270LOWMacPaw The Unarchiver before 4.3.6 contains vulnerability related to missing quarantine attributes for extracted items.EPSS 0.1%CVE-2024-34018MEDIUMSensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) befoEPSS 0.1%CVE-2025-4081MEDIUMTCC Bypass via Dylib Substitution in DaVinci ResolveEPSS 0.1%CVE-2025-57854MEDIUMOsus-operator: privilege escalation via excessive /etc/passwd permissionsEPSS 0.1%CVE-2025-58713MEDIUMRhpam: privilege escalation via excessive /etc/passwd permissionsEPSS 0.1%CVE-2024-22430MEDIUM Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local low privileges maliciEPSS 0.1%CVE-2023-29081MEDIUMInstallShield Symlink Vulnerability Affecting Suite Project SetupsEPSS 0.1%CVE-2025-24788MEDIUMSnowflake Connector for .NET has weak temporary files permissionsEPSS 0.1%CVE-2024-51764MEDIUMA security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS). Depending on configuration, this vulnerabiEPSS 0.1%CVE-2026-92252MEDIUMIncorrect Default Permissions in WatchDog Anti-Virus Installation DirectoryEPSS 0.1%CVE-2025-15642MEDIUMNetskope Client Service Insufficient Access ControlsEPSS 0.1%CVE-2024-10183MEDIUMArbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege EscalationEPSS 0.1%CVE-2024-51765MEDIUMA security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability mEPSS 0.1%CVE-2024-25647MEDIUMIncorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticatEPSS 0.1%CVE-2026-21074HIGHIncorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute arbitrary commands with Bixby privilege.EPSS 0.1%CVE-2024-21840HIGHDirectory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenterEPSS 0.1%CVE-2024-22385MEDIUMFile and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenterEPSS 0.1%CVE-2026-48722MEDIUMNextflow: Incorrect default permissions in the nextflow auth login commandEPSS 0.1%