Fallos del tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2024-54131HIGHKolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)EPSS 0.2%CVE-2025-57849MEDIUMFuse: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2025-52900MEDIUMFile Browser has Insecure File PermissionsEPSS 0.2%CVE-2021-36781MEDIUMparsec: dangerous 777 permissions for /run/parsecEPSS 0.2%CVE-2022-3431MEDIUMA potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deaEPSS 0.2%CVE-2024-35287MEDIUMA vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated atEPSS 0.2%CVE-2016-20029MEDIUMZKTeco ZKBioSecurity 3.0 File Path Manipulation VulnerabilityEPSS 0.2%CVE-2025-58712MEDIUMAmq: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2025-7672LOWStored-XSS possibility in Namo CrossEditor4EPSS 0.2%CVE-2013-4281MEDIUMIn Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could alEPSS 0.2%CVE-2024-1605MEDIUMDLL side-loading in BMC Control-MEPSS 0.2%CVE-2024-3779MEDIUMDenial of Service in ESET products for WindowsEPSS 0.2%CVE-2025-34332HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPEEPSS 0.2%CVE-2025-34333HIGHAudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPEEPSS 0.2%CVE-2020-29503MEDIUMDell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. A locally authenticated attacker could potentiaEPSS 0.2%CVE-2025-36632HIGHLocal Privilege EscalationEPSS 0.2%CVE-2024-2819MEDIUMFile Permission Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2021-3462MEDIUMA privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthoEPSS 0.2%CVE-2021-22817—A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leadinEPSS 0.2%CVE-2023-35183HIGHSolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation VulnerabilityEPSS 0.2%