Fallos del tipo CWE-708

20 resultados

Atribuição Incorreta de Proprietário

Ocorre quando um recurso do sistema (arquivo, diretório, processo, socket) é criado ou modificado com permissões de acesso atribuídas a um usuário ou grupo errado. Isso expõe o recurso a acessos não autorizados ou permite que um atacante assuma controle de componentes críticos.

Ejemplo

Uma aplicação cria um arquivo de configuração com credenciais do banco de dados usando umask permissivo, resultando em permissões 644 (legível por todos) em vez de 600 (somente proprietário). Um usuário local consegue ler o arquivo e extrair as credenciais.

Cómo mitigar

Defina explicitamente proprietário e grupo (chown) e permissões (chmod) ao criar recursos sensíveis. Valide as permissões resultantes antes de armazenar dados críticos e use umask apropriado (0077) para aplicações que manipulam segredos.

CVE-2021-32726HIGHWebauthn tokens not removed after user has been deletedEPSS 1.8%CVE-2021-32689HIGHNextcloud Talk not properly disassociating users from chats after account deletionEPSS 1.0%CVE-2022-33737—The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a randEPSS 0.8%CVE-2023-4008MEDIUMIncorrect Ownership Assignment in GitLabEPSS 0.7%CVE-2024-9633LOWIncorrect Ownership Assignment in GitLabEPSS 0.4%CVE-2023-41881LOWDeleting a collaboration should also delete linked resourcesEPSS 0.3%CVE-2024-45426MEDIUMZoom Workplace Apps - Incorrect Ownership AssignmentEPSS 0.3%CVE-2024-41773MEDIUMIBM Global Configuration Management incorrect ownership assignmentEPSS 0.3%CVE-2026-40196HIGHHomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access RevocationEPSS 0.2%CVE-2024-52561HIGHA privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a EPSS 0.2%CVE-2026-32691MEDIUMTiming ownership claim attack on new external back-end secretsEPSS 0.2%CVE-2025-5069LOWIncorrect Ownership Assignment in GitLabEPSS 0.2%CVE-2021-26248MEDIUMPhilips MRI 1.5T and 3T Incorrect Ownership AssignmentEPSS 0.2%CVE-2022-22189HIGHContrail Service Orchestration: An authenticated local user may have their permissions elevated via the device via management interface without authenticationEPSS 0.2%CVE-2023-20043MEDIUMA vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iEPSS 0.2%CVE-2024-45417MEDIUMZoom Apps for macOS - Uncontrolled Resource ConsumptionEPSS 0.2%CVE-2025-14262MEDIUMJobs can be saved as workflows with wrong permissions on KNIME Business HubEPSS 0.2%CVE-2025-5467LOWUbuntu Apport Insecure File Permissions VulnerabilityEPSS 0.2%CVE-2023-29122MEDIUMIncorrect file ownership of privileged service's libraries in Enel X JuiceBoxEPSS 0.2%CVE-2023-20044MEDIUMA vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability iEPSS 0.1%