Fallos del tipo CWE-377

107 resultados

Arquivo temporário inseguro

A aplicação cria arquivos temporários com permissões previsíveis ou sem isolamento adequado, permitindo que outros usuários do sistema leiam, modifiquem ou substituam esses arquivos. Isso expõe dados sensíveis ou permite injeção de conteúdo malicioso que a aplicação depois processa.

Ejemplo

Um programa cria `/tmp/dados_usuario_12345.txt` com permissões 644 (legível globalmente) para armazenar temporariamente credenciais antes de criptografá-las. Outro usuário da máquina lê o arquivo e rouba as credenciais, ou substitui o conteúdo antes da aplicação processá-lo.

Cómo mitigar

Use APIs seguras (`mkstemp`, `tmpfile`, `Files.createTempFile`) que geram nomes aleatórios e garantem permissões restritivas (0600). Armazene temporários em diretórios isolados por usuário ou processo, e delete imediatamente após uso. Nunca construa nomes de arquivo com valores previsíveis em `/tmp`.

CVE-2024-34490MEDIUMIn Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controllEPSS 0.2%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.2%CVE-2026-4822HIGHEnter Software Iperius Backup Backup Service temp fileEPSS 0.2%CVE-2026-46406MEDIUMClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File WriteEPSS 0.2%CVE-2022-34387MEDIUM Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilEPSS 0.2%CVE-2026-63404HIGHFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)EPSS 0.2%CVE-2025-61659MEDIUMbash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2025-9474LOWMihomo Party Socket sysproxy.ts enableSysProxy temp fileEPSS 0.1%CVE-2026-40973HIGHA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seEPSS 0.1%CVE-2026-20618MEDIUMAn issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access userEPSS 0.1%CVE-2026-35342LOWuutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIREPSS 0.1%CVE-2021-22572MEDIUMData-transfer-project information disclosure via tmp directoryEPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%CVE-2025-46369HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2015-0849LOWpycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.EPSS 0.1%CVE-2025-46368MEDIUMDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2026-25701HIGHAn Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects likeEPSS 0.1%CVE-2025-14612MEDIUMQuartus Prime Pro Edition AdvisoryEPSS 0.1%