Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2025-26168HIGHIXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuratiEPSS 0.2%CVE-2022-42972HIGHA CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a locEPSS 0.2%CVE-2026-64613MEDIUMData::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOWEPSS 0.2%CVE-2024-28745LOWImproper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed onEPSS 0.2%CVE-2022-36122HIGHThe Automox Agent before 40 on Windows incorrectly sets permissions on key files.EPSS 0.2%CVE-2022-44725HIGHOPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal uEPSS 0.2%CVE-2026-26422HIGHclash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.EPSS 0.2%CVE-2023-3282MEDIUMCortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR EngineEPSS 0.2%CVE-2024-6780LOWImproper permission control in com.android.server.telecomEPSS 0.2%CVE-2024-0128HIGHNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A suEPSS 0.2%CVE-2023-52554MEDIUMPermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.2%CVE-2026-34450MEDIUMClaude SDK for Python: Insecure Default File Permissions in Local Filesystem Memory ToolEPSS 0.2%CVE-2022-41699HIGHIncorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticatEPSS 0.2%CVE-2025-2098HIGHDylib Hijacking in Fast CAD ReaderEPSS 0.2%CVE-2026-59946MEDIUMComposer: Path traversal in package bin field lets dependencies chmod arbitrary host filesEPSS 0.2%CVE-2025-43268HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gaEPSS 0.2%CVE-2025-30408MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoEPSS 0.2%CVE-2026-69108HIGHA vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a localEPSS 0.2%CVE-2025-30661HIGHJunos OS: Low-privileged user can cause script to run as root, leading to privilege escalationEPSS 0.2%CVE-2025-36537HIGHIncorrect Permission Assignment for Critical Resource in TeamViewer Remote ManagementEPSS 0.2%