Weaknesses of type CWE-732

785 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2026-32315MEDIUMmotionEye: World-Readable Configuration File Exposes Admin Password HashEPSS 2.9%CVE-2025-10643CRITICALWondershare Repairit Incorrect Permission Assignment Authentication Bypass VulnerabilityEPSS 2.8%CVE-2018-17892—NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security featuEPSS 2.8%CVE-2021-43359HIGHSunnet eHRD - Broken Access ControlEPSS 2.4%CVE-2018-11116HIGHOpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call aEPSS 2.4%CVE-2022-32778HIGHAn information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cEPSS 2.4%CVE-2022-32777HIGHAn information disclosure vulnerability exists in the cookie functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. The session cEPSS 2.4%CVE-2018-7311HIGHPrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runsEPSS 2.2%CVE-2021-43019HIGHAdobe Creative Cloud Incorrect Permission Assignment Privilege Escalation VulnerabilityEPSS 2.2%CVE-2023-25438HIGHAn issue was discovered in Genomedics MilleGP5 5.9.2, allows remote attackers to execute arbitrary code and gain escalated privileges via moEPSS 2.1%CVE-2020-17415HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF 10.0.0.35798. An attacker musEPSS 2.1%CVE-2020-17414HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Foxit Reader 10.0.0.35798. An attacker must fiEPSS 1.9%CVE-2025-34288HIGHNagios XI Privilege Escalation via Writable PHP Include Executed with SudoEPSS 1.9%CVE-2019-3893MEDIUMIn Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the EPSS 1.8%CVE-2024-7513HIGHRockwell Automation FactoryTalk® View Site Edition Code Execution Vulnerability via File PermissionsEPSS 1.7%CVE-2022-1348MEDIUMA vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple iEPSS 1.6%CVE-2021-39235—Access mode of block tokens are not enforcedEPSS 1.6%CVE-2012-10030CRITICALFreeFloat FTP Server Arbitrary File UploadEPSS 1.5%CVE-2024-21305MEDIUMHypervisor-Protected Code Integrity (HVCI) Security Feature Bypass VulnerabilityEPSS 1.5%CVE-2022-28802HIGHCode by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other wEPSS 1.4%