Weaknesses of type CWE-281

232 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2024-37649MEDIUMInsecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtEPSS 0.3%CVE-2025-21544MEDIUMVulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).EPSS 0.3%CVE-2026-101306CRITICALMultiple jail filesystem root escapesEPSS 0.3%CVE-2026-34600MEDIUMJoplin Server delta API returns note content after share access is revokedEPSS 0.3%CVE-2024-12125HIGH3scale-porta: readonly fields not validated server-sideEPSS 0.3%CVE-2025-31184HIGHThis issue was addressed with improved permissions checking. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.EPSS 0.3%CVE-2024-40828HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicEPSS 0.3%CVE-2022-4139HIGHAn incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or dataEPSS 0.3%CVE-2024-54513MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, tvOS 18EPSS 0.3%CVE-2024-52869MEDIUMCertain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when theEPSS 0.3%CVE-2025-30449HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 0.3%CVE-2022-31237LOWDell PowerScale OneFS, versions 9.2.0 up to and including 9.2.1.12 and 9.3.0.5 contain an improper preservation of permissions vulnerabilityEPSS 0.3%CVE-2022-42260HIGHNVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VEPSS 0.3%CVE-2024-47270LOWImproper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9EPSS 0.2%CVE-2026-24834CRITICALKata Container to Guest micro VM privilege escalationEPSS 0.2%CVE-2022-44020MEDIUMAn issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with thEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2023-25646HIGHPermission and Access Control Vulnerability in ZTE H388XEPSS 0.2%CVE-2023-32388—A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, EPSS 0.2%CVE-2024-40805HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.EPSS 0.2%