Fallos del tipo CWE-275

54 resultados

Problemas de Permissões

É quando um sistema não valida ou aplica corretamente as permissões de acesso a recursos (arquivos, diretórios, APIs, funcionalidades). Um usuário consegue acessar, modificar ou executar algo que não deveria ter permissão, porque o controle de acesso foi negligenciado ou mal implementado.

Ejemplo

Um aplicativo web permite que qualquer usuário logado acesse o painel administrativo porque a verificação de role/perfil não foi feita na rota, ou um arquivo de configuração fica com permissões 644 em vez de 600, permitindo que outro usuário local leia dados sensíveis.

Cómo mitigar

Sempre validar e enforçar permissões no servidor (nunca confiar apenas no cliente). Use controle de acesso baseado em roles (RBAC) ou atributos (ABAC), verifique permissões antes de cada operação sensível, e defina permissões de arquivo/diretório restritivas por padrão (princípio do menor privilégio).

CVE-2023-39399CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2023-39398CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.4%CVE-2020-8471HIGHABB Central Licensing System - Weak File PermissionsEPSS 0.4%CVE-2014-1422MEDIUMLocation service uses cached authorization even after revocationEPSS 0.4%CVE-2026-19376MEDIUMUasoft Badaso File API api.php class permissionEPSS 0.4%CVE-2022-25153HIGHITarian - Local privilege escalation in Endpoint Manager agent on WindowsEPSS 0.3%CVE-2024-11485MEDIUMCode4Berry Decoration Management System User userregister.php permissionEPSS 0.3%CVE-2018-0392—A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulEPSS 0.3%CVE-2024-11486MEDIUMCode4Berry Decoration Management System User Permission user_permission.phpEPSS 0.3%CVE-2020-6022—Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.EPSS 0.3%CVE-2020-8474HIGHABB System 800xA Weak Registry PermissionsEPSS 0.3%CVE-2023-37238—Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitaEPSS 0.3%CVE-2021-22566MEDIUMIncorrect mapping of Executable bits in Fuchsia KernelEPSS 0.3%CVE-2018-0449MEDIUMCisco Jabber Client Framework Insecure Directory Permissions VulnerabilityEPSS 0.3%CVE-2026-75978MEDIUMxianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permissionEPSS 0.3%CVE-2019-12622MEDIUMCisco RoomOS Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2019-15962MEDIUMCisco TelePresence Collaboration Endpoint Software Arbitrary File Write VulnerabilityEPSS 0.3%CVE-2021-22571MEDIUMInformation Leak in SA360-webquery-bigquery through read on /tmpEPSS 0.2%CVE-2022-22251HIGHcSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privilegesEPSS 0.2%CVE-2025-54624MEDIUMUnexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.2%