Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2024-13813HIGHInsufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary fileEPSS 0.2%CVE-2023-30897HIGHA vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for EPSS 0.2%CVE-2024-9842HIGHIncorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary foldersEPSS 0.2%CVE-2024-5915MEDIUMGlobalProtect App: Local Privilege Escalation (PE) VulnerabilityEPSS 0.2%CVE-2026-76261MEDIUMInsecure Default Access Control List through the REST API in Splunk Secure GatewayEPSS 0.2%CVE-2019-18243—HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. ThEPSS 0.2%CVE-2022-43517HIGHA vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306). The affected application improperly assigns file permissiEPSS 0.2%CVE-2019-18255—HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects.EPSS 0.2%CVE-2024-10256HIGHInsufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.EPSS 0.2%CVE-2026-65940MEDIUMWhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.EPSS 0.2%CVE-2023-44387LOWGradle has incorrect permission assignment for symlinked files used in copy or archiving operationsEPSS 0.2%CVE-2020-36938HIGHWinAVR Version 20100110 - Insecure Folder PermissionsEPSS 0.2%CVE-2025-13733HIGHBuhoNTFS 1.3.2 - Local Privilege EscalationEPSS 0.2%CVE-2025-64319MEDIUMIncorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating WriteabEPSS 0.2%CVE-2025-64322MEDIUMIncorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable CEPSS 0.2%CVE-2024-7245HIGHPanda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-14740MEDIUMDocker Desktop for Windows Incorrect Permission Assignment Privilege Escalation VulnerabilitiesEPSS 0.2%CVE-2025-1413HIGHDylib Hijacking in DaVinci ResolveEPSS 0.2%CVE-2022-22141—'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL cEPSS 0.2%CVE-2024-7572HIGHInsufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.EPSS 0.2%