Weaknesses of type CWE-276

954 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2024-22385MEDIUMFile and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenterEPSS 0.1%CVE-2023-28389MEDIUMIncorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentiaEPSS 0.1%CVE-2023-6457MEDIUMFile and Directory Permission Vulnerability in Hitachi Tuning ManagerEPSS 0.1%CVE-2025-23105HIGHAn issue was discovered in Samsung Mobile Processor Exynos 2200, 1480, and 2400. A Use-After-Free in the mobile processor leads to privilegeEPSS 0.1%CVE-2025-24795MEDIUMThe Snowflake Connector for Python uses insecure cache files permissionsEPSS 0.1%CVE-2026-28727HIGHLocal privilege escalation due to insecure Unix socket permissions. The following products are affected: Acronis Cyber Protect 17 (macOS) beEPSS 0.1%CVE-2026-44468HIGHIncorrect Default Permissions in CODESYS Development SystemEPSS 0.1%CVE-2023-2737MEDIUMImproper securing of log directory may allow a denial of serviceEPSS 0.1%CVE-2024-5474MEDIUMA potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2EPSS 0.1%CVE-2024-49389HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before buiEPSS 0.1%CVE-2025-61970HIGHWeak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary codEPSS 0.1%CVE-2025-46185MEDIUMAn Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensitive information via the plaintext storaEPSS 0.1%CVE-2023-27505MEDIUMIncorrect default permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installers before version 22.1 .1 may allow EPSS 0.1%CVE-2024-27264HIGHIBM Performance Tools for i privilege escalationEPSS 0.1%CVE-2025-21106MEDIUMDell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could poEPSS 0.1%CVE-2023-32547MEDIUMIncorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to poteEPSS 0.1%CVE-2023-31246MEDIUMIncorrect default permissions in some Intel(R) SDP Tool software before version 1.4 build 5 may allow an authenticated user to potentially eEPSS 0.1%CVE-2026-40952HIGHPrivilge misconfiguration in Secure Access installersEPSS 0.1%CVE-2026-58564HIGHDell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with lEPSS 0.1%CVE-2023-32543MEDIUMIncorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation oEPSS 0.1%