Fallos del tipo CWE-378

46 resultados

Criação de arquivo temporário com permissões inseguras

A aplicação cria arquivos temporários com permissões de leitura/escrita muito abertas (ex: 0666), permitindo que qualquer usuário local acesse, modifique ou substitua seu conteúdo. Se o arquivo contém dados sensíveis ou é usado para carregar código/configuração, um atacante local pode ler segredos, injetar malware ou alterar comportamento da aplicação.

Ejemplo

Um serviço de backup cria `/tmp/backup_XXXXX.sql` com permissões 0666, mantendo credenciais do banco de dados em texto plano. Um usuário local lê o arquivo, rouba as credenciais ou o substitui por um SQL malicioso que será executado na próxima restauração.

Cómo mitigar

Use APIs seguras para criar temporários (ex: `mkstemp()` em C, `NamedTemporaryFile()` em Python, `Files.createTempFile()` em Java) que automaticamente restringem permissões a 0600. Nunca crie com `File.createNewFile()` ou `fopen()` simples. Valide o proprietário do arquivo antes de ler e armazene dados sensíveis fora de `/tmp`.

CVE-2020-27216—In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sysEPSS 4.4%CVE-2021-21290MEDIUMLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesEPSS 1.8%CVE-2016-9485—On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because it fails to set any permissions on downloaded file objectsEPSS 1.2%CVE-2022-24823MEDIUMLocal Information Disclosure Vulnerability in io.netty:netty-codec-httpEPSS 1.0%CVE-2020-8908LOWTemp directory permission issue in GuavaEPSS 1.0%CVE-2021-28168MEDIUMEclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use EPSS 0.9%CVE-2023-0482MEDIUMIn RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates teEPSS 0.8%CVE-2021-25654MEDIUMAvaya Aura Device Services Arbitrary Code Execution VulnerabilityEPSS 0.8%CVE-2025-4953HIGHPodman: build context bind mountEPSS 0.6%CVE-2021-21331LOWDataDog API Client contains a Local Information Disclosure VulnerabilityEPSS 0.6%CVE-2021-29428HIGHLocal privilege escalation through system temporary directoryEPSS 0.5%CVE-2021-1496HIGHCisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesEPSS 0.5%CVE-2024-39872CRITICALA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application does not properly asEPSS 0.5%CVE-2021-21363MEDIUMGenerator Web Application: Local Privilege Escalation Vulnerability via System Temp DirectoryEPSS 0.4%CVE-2024-23454MEDIUMApache Hadoop: Temporary File Local Information DisclosureEPSS 0.4%CVE-2021-25314HIGHhawk: Insecure file permissionsEPSS 0.4%CVE-2025-32979MEDIUMNETSCOUT nGeniusONE before 6.4.0 b2350 allows Arbitrary File Creation by authenticated users.EPSS 0.3%CVE-2021-21364MEDIUMGenerated Code Contains Local Information Disclosure VulnerabilityEPSS 0.3%CVE-2021-1428HIGHCisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesEPSS 0.2%CVE-2021-1429HIGHCisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesEPSS 0.2%