Weaknesses of type CWE-281

232 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2024-2819MEDIUMFile Permission Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2024-22405MEDIUMXADMaster may not apply quarantine attribute correctly to extracted filesEPSS 0.2%CVE-2024-44188MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protecEPSS 0.2%CVE-2023-43612HIGHHiview has an improper preservation of permissions vulnerabilityEPSS 0.2%CVE-2024-36062MEDIUMThe com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no peEPSS 0.2%CVE-2024-27858MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protecEPSS 0.2%CVE-2024-40859MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sEPSS 0.2%CVE-2026-88016HIGHrclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationEPSS 0.2%CVE-2024-3289HIGHWhen installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secEPSS 0.2%CVE-2024-27888HIGHA permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An appEPSS 0.2%CVE-2025-10149HIGHArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverEPSS 0.2%CVE-2024-3291HIGHPrivilege EscalationEPSS 0.2%CVE-2025-8325MEDIUMImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsEPSS 0.2%CVE-2026-58494MEDIUMWasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationEPSS 0.2%CVE-2024-46941MEDIUMSystemUI component protection settings vulnerabilityEPSS 0.2%CVE-2023-0975HIGH A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, toEPSS 0.2%CVE-2024-53934HIGHThe com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enablesEPSS 0.2%CVE-2025-9615LOWNetworkmanager: networkmanager file accessEPSS 0.2%CVE-2024-54516LOWA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may bEPSS 0.2%CVE-2026-82964HIGHAvast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysEPSS 0.2%