Weaknesses of type CWE-276

952 results

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, banco de dados, serviço) é criado com permissões padrão excessivamente permissivas, expondo dados ou funcionalidades a usuários não autorizados. O desenvolvedor ou administrador não restringe explicitamente o acesso, deixando a configuração padrão do sistema, que geralmente é insegura.

Example

Um aplicativo cria arquivos de cache com informações sensíveis (tokens, chaves de API) com permissões 644 (leitura para todos), permitindo que qualquer usuário local da máquina leia esses dados. Ou um bucket S3 é criado com acesso público habilitado por padrão, expondo documentos confidenciais.

How to mitigate

Defina explicitamente permissões restritivas no código (ex: 0600 para arquivos sensíveis, 0700 para diretórios) e revise configurações padrão de infraestrutura antes do deploy. Automatize verificações de permissões em pipelines CI/CD e aplique o princípio do menor privilégio desde a criação dos recursos.

CVE-2022-2366MEDIUMIncorrect defaults can cause attackers to bypass rate limitationsEPSS 0.6%CVE-2023-41726HIGHIvanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation VulnerabilityEPSS 0.6%CVE-2022-47551MEDIUMApiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issuEPSS 0.6%CVE-2023-49338HIGHCouchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8EPSS 0.6%CVE-2024-51162HIGHAn issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. Analyzing the offline client code, itEPSS 0.6%CVE-2022-36803HIGHThe MasterUserEdit API in Atlassian Jira Align Server before version 10.109.2 allows An authenticated attacker with the People role permissiEPSS 0.6%CVE-2024-32978MEDIUMKaminari Insecure File Permissions VulnerabilityEPSS 0.6%CVE-2023-37572HIGHSofting OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permissionEPSS 0.6%CVE-2020-26180MEDIUMDell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with thEPSS 0.6%CVE-2020-13539CRITICALAn exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install direEPSS 0.6%CVE-2022-41572CRITICALAn issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be ruEPSS 0.6%CVE-2025-59030HIGHInsufficient validation of incoming notifies over TCP can lead to a denial of service in RecursorEPSS 0.6%CVE-2021-36397MEDIUMIn Moodle, insufficient capability checks meant message deletions were not limited to the current user.EPSS 0.6%CVE-2025-57625HIGHCYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability. A low-privileged user can abuse these issueEPSS 0.6%CVE-2024-11089MEDIUMAnonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureEPSS 0.6%CVE-2021-3948—An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker EPSS 0.6%CVE-2024-52551HIGHJenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restEPSS 0.6%CVE-2024-54745CRITICALWAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in EPSS 0.6%CVE-2024-54747CRITICALWAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rootEPSS 0.6%CVE-2025-60262CRITICALAn issue in H3C M102G HM1A0V200R010 wireless controller and BA1500L SWBA1A0V100R006 wireless access point, there is a misconfiguration vulneEPSS 0.6%