Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2024-6360MEDIUMIncorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.EPSS 0.3%CVE-2024-1724MEDIUMsnapd allows $HOME/bin symlinkEPSS 0.3%CVE-2023-3322HIGH Code Execution through overwriting service executable in utilities directoryEPSS 0.3%CVE-2026-13673HIGHAn incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-EPSS 0.3%CVE-2019-2389MEDIUMProcess termination via PID file manipulationEPSS 0.3%CVE-2026-76372MEDIUMIncorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAREPSS 0.3%CVE-2024-23223MEDIUMA privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3EPSS 0.3%CVE-2025-21520LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 andEPSS 0.3%CVE-2025-27216HIGHMultiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to eEPSS 0.3%CVE-2025-0374MEDIUMUnprivileged access to system filesEPSS 0.3%CVE-2025-22454HIGHInsufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their EPSS 0.3%CVE-2026-0775HIGHnpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2022-34891HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. AnEPSS 0.3%CVE-2024-39709HIGHIncorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version EPSS 0.3%CVE-2026-82697MEDIUMsambitraj Student-Management-System session_start cookie httponly flagEPSS 0.3%CVE-2012-0433LOWinsecure permissions on files containing confidential dataEPSS 0.3%CVE-2009-3482HIGHTrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGREPSS 0.3%CVE-2020-8473HIGHABB System 800xA Weak File Permissions - ABB System 800xA BaseEPSS 0.3%CVE-2025-20298HIGHIncorrect permission assignment on Universal Forwarder for Windows during new installation or upgradeEPSS 0.3%CVE-2020-8029LOWskuba: Insecure handling of private keyEPSS 0.3%