Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2023-38334—Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it shoEPSS 0.9%CVE-2020-12510HIGHBeckhoff: Privilege Escalation through TwinCat SystemEPSS 0.9%CVE-2023-6302MEDIUMCSZCMS File Manager Page templates permissionEPSS 0.9%CVE-2021-40397HIGHA privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be repEPSS 0.9%CVE-2021-34182CRITICALAn issue in ttyd v.1.6.3 allows attacker to execute arbitrary code via default configuration permissions.EPSS 0.9%CVE-2024-20921MEDIUMVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotEPSS 0.9%CVE-2023-42501MEDIUMApache Superset: Unnecessary read permissions within the Gamma roleEPSS 0.9%CVE-2020-8022HIGHUser-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviligesEPSS 0.9%CVE-2022-29909HIGHDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the exiEPSS 0.9%CVE-2022-1833—A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespaceEPSS 0.8%CVE-2024-2859MEDIUMBy default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859)EPSS 0.8%CVE-2024-34221HIGHSourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation.EPSS 0.8%CVE-2022-20465MEDIUMIn dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic EPSS 0.8%CVE-2023-22951HIGHAn issue was discovered in TigerGraph Enterprise Free Edition 3.x. It creates an authentication token for internal systems use. This token cEPSS 0.8%CVE-2025-24093CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.3, macOS VenturEPSS 0.8%CVE-2024-55959CRITICALNorthern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.EPSS 0.8%CVE-2022-40187HIGHForesight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP portEPSS 0.8%CVE-2022-4039HIGHRhsso-container-image: unsecured management interface exposed to adjecent networkEPSS 0.8%CVE-2020-21514HIGHAn issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default passwEPSS 0.8%CVE-2024-46054CRITICALOpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upEPSS 0.8%