Fallos del tipo CWE-276

978 resultados

Permissões padrão incorretas

Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.

Ejemplo

Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.

Cómo mitigar

Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.

CVE-2022-27651—A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker EnEPSS 1.3%CVE-2024-27144CRITICALPre-authenticated Remote Code ExecutionEPSS 1.2%CVE-2021-21957HIGHA privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A speciallEPSS 1.2%CVE-2022-27650—A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (DoEPSS 1.2%CVE-2023-38335—Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed tEPSS 1.2%CVE-2023-48648CRITICALConcrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. FilEPSS 1.2%CVE-2017-3209—The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous userEPSS 1.2%CVE-2022-25899CRITICALAuthentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthentiEPSS 1.2%CVE-2023-23059CRITICALAn issue was discovered in GeoVision GV-Edge Recording Manager 2.2.3.0 for windows, which contains improper permissions within the default iEPSS 1.2%CVE-2024-38222MEDIUMMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 1.2%CVE-2025-4660HIGHRemote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe AccessEPSS 1.2%CVE-2022-44929CRITICALAn access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SEPSS 1.2%CVE-2025-24238CRITICALA logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, EPSS 1.1%CVE-2022-30759HIGHIn Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root priviEPSS 1.1%CVE-2022-3368HIGHSoftware Updater of Avira Security for Windows vulnerable to Privilege EscalationEPSS 1.1%CVE-2025-29801HIGHMicrosoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2025-30465CRITICALA permissions issue was addressed with improved validation. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sequoia 15.7.2, EPSS 1.1%CVE-2025-24207CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturEPSS 1.1%CVE-2022-45562HIGHInsecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdooEPSS 1.1%CVE-2023-31462—An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writable for all users onEPSS 1.0%