Weaknesses of type CWE-732

792 results

Permissões inadequadas em recursos críticos de segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos, credenciais, configurações críticas ou dados pessoais a quem não deveria ter acesso.

Example

Um arquivo de configuração contendo chaves de API é criado com permissões 644 (legível por qualquer usuário do sistema) ao invés de 600 (apenas o proprietário). Um atacante local lê a chave e compromete a aplicação na nuvem. Ou um diretório temporário armazena tokens de sessão com permissões 777, permitindo que outros processos roubem sessões ativas.

How to mitigate

Aplique o princípio do menor privilégio: configure permissões restritivas no momento da criação (ex: 600 para arquivos sensíveis, 700 para diretórios). Use umask apropriado, revise periodicamente as permissões de recursos críticos e automatize verificações de compliance com ferramentas como Terraform ou Ansible para manter a postura correta.

CVE-2024-45655MEDIUMIBM Application Gateway incorrect permission assignmentEPSS 0.1%CVE-2026-50590MEDIUMIn Mimecast Incydr before 2.6.0, arbitrary file access can occur.EPSS 0.1%CVE-2025-0164LOWIBM QRadar SIEM information disclosureEPSS 0.1%CVE-2025-53396HIGHIncorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whiEPSS 0.1%CVE-2026-7480HIGHAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate priviEPSS 0.1%CVE-2025-38742MEDIUMDell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.EPSS 0.1%CVE-2026-14208HIGHLocal Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0EPSS 0.1%CVE-2024-6510HIGHLocal privilege escalation vulnerability in AVG Internet SecurityEPSS 0.1%CVE-2026-20092MEDIUMCisco Intersight Virtual Appliance Privilege Escalation VulnerabilityEPSS 0.1%CVE-2025-64642HIGHMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2024-32010HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extrEPSS 0.1%CVE-2025-54545HIGHOn affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.EPSS 0.1%CVE-2025-67794HIGHAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the aEPSS 0.1%CVE-2025-20233LOWIncorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File EditingEPSS 0.1%CVE-2026-33271MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before builEPSS 0.1%CVE-2025-11790MEDIUMCredentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentEPSS 0.1%CVE-2025-68462LOWFreedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.EPSS 0.1%CVE-2025-59349LOWDirectories created via os.MkdirAll are not checked for permissionsEPSS 0.1%CVE-2026-8070HIGHIncorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, reEPSS 0.1%CVE-2019-25343HIGHNextVPN 4.10 - Insecure File PermissionsEPSS 0.1%