Weaknesses of type CWE-281

232 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2023-1386LOWQemu: 9pfs: suid/sgid bits not dropped on file writeEPSS 0.2%CVE-2024-22121MEDIUMZabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exeEPSS 0.2%CVE-2025-0914LOWVelociraptor Shell Plugin Prevent_execve BypassEPSS 0.2%CVE-2023-32400—This issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. EntitlementEPSS 0.2%CVE-2022-4326MEDIUMTrellix xAgent permission bypass vulnerabilityEPSS 0.2%CVE-2023-28646MEDIUMApp lockout in nextcloud Android app can be bypassed via thirdparty appsEPSS 0.2%CVE-2024-40821HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VEPSS 0.2%CVE-2024-50931MEDIUMSilicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.EPSS 0.2%CVE-2022-21203HIGHImproper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authentiEPSS 0.2%CVE-2024-54484MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2023-32199MEDIUMRancher user retains access to clusters despite Global Role removalEPSS 0.2%CVE-2024-50929MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in theEPSS 0.2%CVE-2020-15113MEDIUMImproper Preservation of Permissions in etcdEPSS 0.2%CVE-2024-40811HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify protected parts of the EPSS 0.2%CVE-2025-24087MEDIUMThe issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protecteEPSS 0.2%CVE-2024-54515HIGHA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root EPSS 0.2%CVE-2023-42867HIGHThis issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app mEPSS 0.2%CVE-2020-12744HIGHThe MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.EPSS 0.2%CVE-2025-24337HIGHWriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.EPSS 0.2%CVE-2024-40831MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a userEPSS 0.2%