Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-1067HIGHThere is a code injection vulnerability in ArcGIS ProEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2025-21551MEDIUMVulnerability in the Oracle Solaris product of Oracle Systems (component: File system). The supported version that is affected is 11. EasiEPSS 0.2%CVE-2021-34758MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilityEPSS 0.2%CVE-2024-38864MEDIUMUser-Readable Private Key in Windows AgentEPSS 0.2%CVE-2021-36280HIGHDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could EPSS 0.2%CVE-2026-55441HIGHmise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryEPSS 0.2%CVE-2020-5385MEDIUMDell Encryption versions prior to 10.8 and Dell Endpoint Security Suite versions prior to 2.8 contain a privilege escalation vulnerability bEPSS 0.2%CVE-2023-1516HIGHRoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a localEPSS 0.2%CVE-2024-22029HIGHtomcat packaging allows for escalation to root from tomcat userEPSS 0.2%CVE-2025-27446HIGHApache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privilegesEPSS 0.2%CVE-2026-2637HIGHiBoysoft NTFS for Mac contains a local privilege escalation vulnerability in its privileged helper daemon ntfshelperd. The daemon exposes anEPSS 0.2%CVE-2023-28399HIGHIncorrect permission assignment for critical resource exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. ACL (Access Control ListEPSS 0.2%CVE-2023-27084MEDIUMPermissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentCEPSS 0.2%CVE-2026-95667MEDIUMMISP Installer Log and FIFO Created World-Readable, Exposing Sensitive CredentialsEPSS 0.2%CVE-2024-54159MEDIUMstalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.EPSS 0.2%CVE-2026-79783LOWrclone before 1.74.4 Privilege Escalation via setuid MetadataEPSS 0.2%CVE-2026-12957HIGHArbitrary Code Execution in Language Servers for AWSEPSS 0.2%CVE-2022-41771MEDIUMIncorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticatEPSS 0.2%CVE-2024-38646HIGHNotes Station 3EPSS 0.2%