Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-21571HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 0.3%CVE-2019-0073MEDIUMJunos OS: PKI key pairs are exported with insecure file permissionsEPSS 0.3%CVE-2024-9244HIGHFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-61892HIGHWeintek cMT3092X Incorrect Permission Assignment for Critical ResourceEPSS 0.3%CVE-2021-21364MEDIUMGenerated Code Contains Local Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-29869MEDIUMApache Hive: Credentials file created with non restrictive permissionsEPSS 0.3%CVE-2026-32048HIGHOpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawnEPSS 0.3%CVE-2023-31871HIGHOpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to rootEPSS 0.3%CVE-2024-12151MEDIUMIncorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old EPSS 0.3%CVE-2022-41926LOWNextcloud Talk Android broadcast incorrect permission handlingEPSS 0.3%CVE-2020-8472MEDIUMABB System 800xA Weak File Permissions - different productsEPSS 0.3%CVE-2026-24131MEDIUMpnpm has Path Traversal via arbitrary file permission modificationEPSS 0.3%CVE-2025-43759MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 throEPSS 0.3%CVE-2020-1709HIGHA vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etcEPSS 0.3%CVE-2023-38037MEDIUMActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted toEPSS 0.3%CVE-2026-50570HIGHFission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruptionEPSS 0.3%CVE-2024-5930HIGHVIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-10059MEDIUMMongoDB Server router will crash when incorrect lsid is set on a sharded queryEPSS 0.3%CVE-2016-9604MEDIUMIt was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEPSS 0.3%CVE-2025-62251MEDIUMLiferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 aEPSS 0.3%