Weaknesses of type CWE-279

26 results

Permissões incorretamente atribuídas na execução

Ocorre quando um processo ou thread recebe permissões diferentes daquelas que deveria ter durante sua execução, ou quando o código falha em validar se as permissões concedidas são realmente as esperadas. Isso permite que um atacante execute operações para as quais não deveria ter privilégio, comprometendo a integridade e confidencialidade do sistema.

Example

Um serviço que deveria rodar com permissões limitadas de usuário é iniciado com privilégios de administrador por engano, ou uma aplicação que verifica permissões em tempo de design mas não revalida em tempo de execução, permitindo que um atacante explore essa brecha para acessar recursos sensíveis.

How to mitigate

Aplique o princípio do menor privilégio: rode processos com as menores permissões necessárias. Revalide permissões no tempo de execução, não apenas em tempo de compilação ou inicialização. Use mecanismos de confinamento (sandboxing, containers com capacidades limitadas) e auditoria de chamadas privilegiadas para detectar anomalias.

CVE-2023-4665HIGHPrivilage Escalation in Saphira ConnectEPSS 1.1%CVE-2024-37734CRITICALAn issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.EPSS 0.8%CVE-2017-8441—Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug EPSS 0.7%CVE-2023-50914MEDIUMA Privilege Escalation issue in the inter-process communication procedure from GOG Galaxy (Beta) 2.0.67.2 through v2.0.71.2 allows authenticEPSS 0.7%CVE-2022-21699HIGHExecution with Unnecessary Privileges in ipythonEPSS 0.7%CVE-2023-3915MEDIUMIncorrect Execution-Assigned Permissions in GitLabEPSS 0.6%CVE-2025-30001HIGHApache StreamPark: Authenticated users can trigger remote command executionEPSS 0.5%CVE-2020-8025MEDIUMoutdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issuesEPSS 0.5%CVE-2025-12801MEDIUMNfs-utils: rpc.mountd in the nfs-utils privilege escalationEPSS 0.5%CVE-2025-14025HIGHAnsible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsEPSS 0.4%CVE-2025-58437HIGHCoder's privilege escalation vulnerability could lead to a cross workspace compromiseEPSS 0.4%CVE-2023-4383HIGHMicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissionsEPSS 0.3%CVE-2024-39286LOWIncorrect execution-assigned permissions in the Linux kernel mode driver for the Intel(R) 800 Series Ethernet Driver before version 1.15.4 mEPSS 0.2%CVE-2025-36228LOWIncorrect Execution-Assigned Permissions in IBM Aspera FaspexEPSS 0.2%CVE-2025-20612MEDIUMIncorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated usEPSS 0.2%CVE-2025-23233MEDIUMIncorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticated usEPSS 0.2%CVE-2025-23263HIGHNVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privilegEPSS 0.2%CVE-2024-25621HIGHcontainerd affected by a local privilege escalation via wide permissions on CRI directoryEPSS 0.2%CVE-2024-11220HIGHOpen Automation Software Incorrect Execution-Assigned PermissionsEPSS 0.2%CVE-2024-37025MEDIUMIncorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 mEPSS 0.2%