Fallos del tipo CWE-281

225 resultados

Preservação inadequada de permissões

É quando um sistema copia, move ou cria arquivos, diretórios ou outros recursos sem manter ou validar corretamente as permissões originais, resultando em acesso indevido. Um atacante pode ganhar acesso a dados sensíveis ou executar operações que não deveria poder fazer porque as permissões foram perdidas, relaxadas ou não propagadas corretamente.

Ejemplo

Um backup automático copia arquivos de um diretório protegido (modo 600) para uma pasta temporária, mas o processo não preserva as permissões originais. Os arquivos acabam com permissões padrão (644), permitindo que qualquer usuário do sistema leia dados sensíveis que deveriam ser privados.

Cómo mitigar

Ao copiar, mover ou criar recursos, sempre preserve explicitamente as permissões originais usando APIs que suportam isso (como `cp -p`, `shutil.copystat()` em Python, ou equivalentes). Valide permissões antes e depois da operação e teste cenários onde dados sensíveis são envolvidos.

CVE-2024-40821HIGHAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS VEPSS 0.2%CVE-2020-15113MEDIUMImproper Preservation of Permissions in etcdEPSS 0.2%CVE-2024-50931MEDIUMSilicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.EPSS 0.2%CVE-2026-24834CRITICALKata Container to Guest micro VM privilege escalationEPSS 0.2%CVE-2022-4326MEDIUMTrellix xAgent permission bypass vulnerabilityEPSS 0.2%CVE-2022-21203HIGHImproper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authentiEPSS 0.2%CVE-2024-54484MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data.EPSS 0.2%CVE-2024-50929MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in theEPSS 0.2%CVE-2024-40811HIGHThe issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to modify protected parts of the EPSS 0.2%CVE-2025-24087MEDIUMThe issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protecteEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2024-54515HIGHA logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.2. A malicious app may be able to gain root EPSS 0.2%CVE-2023-42867HIGHThis issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app mEPSS 0.2%CVE-2026-58510MEDIUMGHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->privateEPSS 0.2%CVE-2025-24337HIGHWriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.EPSS 0.2%CVE-2024-40831MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a userEPSS 0.2%CVE-2023-32199MEDIUMRancher user retains access to clusters despite Global Role removalEPSS 0.2%CVE-2024-2819MEDIUMFile Permission Vulnerability in Hitachi Ops Center Common ServicesEPSS 0.2%CVE-2020-12744HIGHThe MSI installer in Verint Desktop Resources 15.2 allows an unprivileged local user to elevate their privileges during install or repair.EPSS 0.2%CVE-2024-22405MEDIUMXADMaster may not apply quarantine attribute correctly to extracted filesEPSS 0.2%