Fallos del tipo CWE-276
981 resultadosPermissões padrão incorretas
Ocorre quando um software cria arquivos, diretórios ou recursos com permissões padrão muito permissivas, expondo dados sensíveis a usuários não autorizados do sistema. O risco é que qualquer outro processo ou usuário consegue ler, modificar ou deletar informações que deveriam ser privadas.
Ejemplo
Um aplicativo cria um arquivo de configuração com senha de banco de dados com permissões 0644 (legível por qualquer usuário), em vez de 0600 (só o dono). Outro usuário no mesmo servidor consegue ler esse arquivo e obtém as credenciais.
Cómo mitigar
Defina permissões explícitas e restritivas no ato da criação (use umask apropriado, chmod, ou APIs de segurança). Sempre revise e documente quais permissões cada recurso deve ter, testando a realidade no sistema de arquivos ou controle de acesso após o deploy.
CVE-2023-27305MEDIUMIncorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentEPSS 0.2%CVE-2023-40154MEDIUMIncorrect default permissions in the Intel(R) SUR for Gameplay Software before version 2.0.1901 may allow privillaged user to potentially enEPSS 0.2%CVE-2023-41231MEDIUMIncorrect default permissions in some ACAT software maintained by Intel(R) before version 2.0.0 may allow an authenticated user to potentialEPSS 0.2%CVE-2023-32638MEDIUMIncorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially eEPSS 0.2%CVE-2023-28739MEDIUMIncorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potEPSS 0.2%CVE-2025-12100HIGHMongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directoriesEPSS 0.2%CVE-2022-48685HIGHAn issue was discovered in Logpoint 7.1 before 7.1.2. The daily executed cron file clean_secbi_old_logs is writable by all users and is execEPSS 0.2%CVE-2020-29489MEDIUMDell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentiEPSS 0.2%CVE-2024-55957HIGHIn Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver pacEPSS 0.2%CVE-2025-0542HIGHG DATA Management Server Local privilege escalationEPSS 0.2%CVE-2025-23347HIGHNVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful exploit of this vulneEPSS 0.2%CVE-2024-53921LOWAn issue was discovered in the installer in Samsung Magician 8.1.0 on Windows. An attacker can create arbitrary folders in the system permisEPSS 0.2%CVE-2024-45067MEDIUMIncorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentialEPSS 0.2%CVE-2024-3904HIGHIncorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions EPSS 0.2%CVE-2026-85300MEDIUMApache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File PermissionsEPSS 0.2%CVE-2025-46355HIGHIncorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on WiEPSS 0.2%CVE-2023-30905—The MC990 X and UV300 RMC component has and inadequate default configuration that could be exploited to obtain enhanced privilege.EPSS 0.2%CVE-2023-28966HIGHJunos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootEPSS 0.2%CVE-2025-57853MEDIUMWeb-terminal: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2024-2175HIGHAn insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)EPSS 0.2%