Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2024-46060HIGHAnaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directEPSS 0.2%CVE-2024-46062HIGHMiniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home direcEPSS 0.2%CVE-2024-8256MEDIUMIncorrect Permission Assignment in RutOS based routers and TSWOS based managed switchesEPSS 0.2%CVE-2021-31377MEDIUMJunos OS: A local authenticated attacker can cause RPD to coreEPSS 0.2%CVE-2026-4761LOWUnnecessary permissions on private keys of certificates installed by Network and Security WizardEPSS 0.2%CVE-2026-78553HIGHInsecure Flask Secret-Key File Permissions Allow Local Administrator Session Forgery in RansomLookEPSS 0.2%CVE-2023-6179HIGHIncorrect Permission assignment to program executable foldersEPSS 0.2%CVE-2021-36279HIGHDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could EPSS 0.2%CVE-2026-64896MEDIUMT2000 open debug portEPSS 0.2%CVE-2025-57392HIGHBenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users gEPSS 0.2%CVE-2023-47712HIGHIBM Security Guardium privilege escalationEPSS 0.2%CVE-2021-36290MEDIUMDell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially expEPSS 0.2%CVE-2024-32478MEDIUMGit Credential Manager (GCM)'s Debian package does not set root ownership on installed filesEPSS 0.2%CVE-2024-20456MEDIUMA vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass theEPSS 0.2%CVE-2020-5358MEDIUMDell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability dEPSS 0.2%CVE-2025-13941HIGHFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-52094HIGHInsecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\SetEPSS 0.2%CVE-2026-41489HIGHPi-hole: Local privilege escalation via config-controlled path in root-executed service hooksEPSS 0.2%CVE-2022-2332MEDIUMHoneywell SoftMaster Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2022-22248HIGHJunos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commandsEPSS 0.2%