Weaknesses of type CWE-732

791 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-34287HIGHNagios XI < 2024R2 Privilege Escalation via process_perfdata.plEPSS 0.3%CVE-2023-49578LOWDenial of service (DOS) in SAP Cloud ConnectorEPSS 0.3%CVE-2026-92941CRITICALvm2 3.11.3 before 3.11.7 TLS Trust Store ManipulationEPSS 0.3%CVE-2024-7594HIGHVault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By DefaultEPSS 0.3%CVE-2024-27883MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VentuEPSS 0.3%CVE-2020-26196MEDIUMDell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. A user with the BackupAdmin role mayEPSS 0.3%CVE-2022-47927MEDIUMAn issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a prEPSS 0.3%CVE-2025-42997MEDIUMInformation Disclosure vulnerability in SAP Gateway ClientEPSS 0.3%CVE-2025-5819MEDIUMIncorrect Permission Assignment for Critical Resource in GitLabEPSS 0.3%CVE-2024-9245HIGHFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-58432MEDIUMMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/giteaEPSS 0.3%CVE-2026-24732MEDIUMImproper permission checks in Extension:NSFileRepoEPSS 0.3%CVE-2022-22516HIGHCODESYS driver SysDrv3S allows SYSTEM users on Microsoft Windows to read and write in restricted memory space.EPSS 0.3%CVE-2024-30369HIGHA10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-62519MEDIUMVulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succession plan). Supported versions that arEPSS 0.3%CVE-2026-59148HIGHMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftEPSS 0.3%CVE-2022-21946MEDIUMsuddoers configuration for cscreen not restrictive enoughEPSS 0.3%CVE-2026-76260MEDIUMIncorrect Permission Assignment for Critical Resource through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2024-39875MEDIUMA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application allows authenticatedEPSS 0.3%CVE-2020-1707HIGHA vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in theEPSS 0.3%