Weaknesses of type CWE-281

225 results

Preservação inadequada de permissões

Ocorre quando uma aplicação cria, copia ou modifica arquivos, processos ou recursos sem manter ou validar as permissões de acesso originais. Isso permite que usuários não autorizados acessem dados sensíveis ou executem operações privilégiadas que deveriam estar restritas.

Example

Um backup de banco de dados é criado com permissões world-readable porque o código copia o arquivo sem preservar o mode 0600 do original, expondo credenciais de produção a qualquer usuário do servidor. Ou um processo filho herda mais privilégios que deveria porque o pai não descarta capabilities do Linux antes de exec().

How to mitigate

Sempre defina explicitamente permissões restritivas ao criar ou copiar recursos sensíveis (chmod 0600 para arquivos, setfacl para ACLs). Valide permissões antes de acessar e remova privilégios desnecessários antes de executar código não confiável (chown, chgrp, umask consciente).

CVE-2020-15113MEDIUMImproper Preservation of Permissions in etcdEPSS 0.2%CVE-2024-40821HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VEPSS 0.2%CVE-2022-4326MEDIUMTrellix xAgent permission bypass vulnerabilityEPSS 0.2%CVE-2026-24834CRITICALKata Container to Guest micro VM privilege escalationEPSS 0.2%CVE-2024-50931MEDIUMSilicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.EPSS 0.2%CVE-2024-54484MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2022-21203HIGHImproper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authentiEPSS 0.2%CVE-2024-50929MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in theEPSS 0.2%CVE-2024-40811HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify protected parts of the EPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2025-24087MEDIUMThe issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protecteEPSS 0.2%CVE-2024-54515HIGHA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root EPSS 0.2%CVE-2023-42867HIGHThis issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app mEPSS 0.2%CVE-2026-58510MEDIUMGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateEPSS 0.2%CVE-2025-24337HIGHWriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.EPSS 0.2%CVE-2024-40831MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a userEPSS 0.2%CVE-2023-32199MEDIUMRancher user retains access to clusters despite Global Role removalEPSS 0.2%CVE-2024-2819MEDIUMFile Permission Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2020-12744HIGHThe MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.EPSS 0.2%CVE-2024-22405MEDIUMXADMaster may not apply quarantine attribute correctly to extracted filesEPSS 0.2%