Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2024-21902MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2023-35841HIGHWinFlash Driver Permissions IssueEPSS 0.4%CVE-2025-24527HIGHAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connectoEPSS 0.4%CVE-2023-52715HIGHThe SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.4%CVE-2017-12713—An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. MultipEPSS 0.4%CVE-2024-30413HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.4%CVE-2023-52388HIGHPermission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.4%CVE-2020-10699HIGHA flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enEPSS 0.3%CVE-2025-55524HIGHInsecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.EPSS 0.3%CVE-2024-46881HIGHDevelocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduEPSS 0.3%CVE-2024-41970MEDIUMWAGO: Unauthorized Diagnostic Data Exposure in Multiple DevicesEPSS 0.3%CVE-2024-27108MEDIUMNon privileged access to critical file vulnerability in GE HealthCare EchoPAC productsEPSS 0.3%CVE-2024-28589MEDIUMAn issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbiEPSS 0.3%CVE-2020-10762—An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This EPSS 0.3%CVE-2026-9508CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStarEPSS 0.3%CVE-2019-3866MEDIUMAn information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were mEPSS 0.3%CVE-2026-95627HIGHTauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursionEPSS 0.3%CVE-2019-18577MEDIUMDell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xEPSS 0.3%CVE-2024-37369HIGHRockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File PermissionsEPSS 0.3%CVE-2023-49582MEDIUMApache Portable Runtime (APR): Unexpected lax shared memory permissionsEPSS 0.3%