Fallos del tipo CWE-377

123 resultados

Arquivo temporário inseguro

A aplicação cria arquivos temporários com permissões previsíveis ou sem isolamento adequado, permitindo que outros usuários do sistema leiam, modifiquem ou substituam esses arquivos. Isso expõe dados sensíveis ou permite injeção de conteúdo malicioso que a aplicação depois processa.

Ejemplo

Um programa cria `/tmp/dados_usuario_12345.txt` com permissões 644 (legível globalmente) para armazenar temporariamente credenciais antes de criptografá-las. Outro usuário da máquina lê o arquivo e rouba as credenciais, ou substitui o conteúdo antes da aplicação processá-lo.

Cómo mitigar

Use APIs seguras (`mkstemp`, `tmpfile`, `Files.createTempFile`) que geram nomes aleatórios e garantem permissões restritivas (0600). Armazene temporários em diretórios isolados por usuário ou processo, e delete imediatamente após uso. Nunca construa nomes de arquivo com valores previsíveis em `/tmp`.

CVE-2025-46369HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2026-35342LOWuutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIREPSS 0.1%CVE-2021-22572MEDIUMData-transfer-project information disclosure via tmp directoryEPSS 0.1%CVE-2026-93864HIGHFireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as RootEPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-73584MEDIUMSblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handlingEPSS 0.1%CVE-2026-16791LOWPredictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLIEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%CVE-2026-82715HIGHInsecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O ServerEPSS 0.1%CVE-2025-46368MEDIUMDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2026-41991LOWPredictable Temporary File in GNU gzipEPSS 0.1%CVE-2026-97209MEDIUMInsecure temporary file in mix deps.partition lets a local user execute code in another user's dependency buildEPSS 0.1%CVE-2026-25701HIGHAn Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects likeEPSS 0.1%CVE-2025-14612MEDIUMQuartus Prime Pro Edition AdvisoryEPSS 0.1%CVE-2025-14614MEDIUMQuartus® Prime Standard and Quartus® Prime Lite Security AdvisoryEPSS 0.1%CVE-2026-106451HIGHyawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userEPSS 0.1%CVE-2026-40979MEDIUMIn Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 EPSS 0.1%CVE-2024-49506HIGHFixed temporary file path in aeon-checks allows fixing of disk encryption keyEPSS 0.1%CVE-2026-41001MEDIUMPredictable Temp Directory in Artemis Auto-configurationEPSS 0.1%CVE-2026-79899HIGHFortra BoKS Manager bccgethostcert insecure temporary file vulnerabilityEPSS 0.1%