Fallos del tipo CWE-732

788 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2024-8039CRITICALImproper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account taEPSS 0.4%CVE-2024-3668HIGHPowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege EscalationEPSS 0.4%CVE-2018-14650MEDIUMIt was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tEPSS 0.4%CVE-2026-49340HIGHgonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the hostEPSS 0.4%CVE-2023-31238MEDIUMA vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsEPSS 0.4%CVE-2024-8900HIGHAn attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnEPSS 0.4%CVE-2023-33004MEDIUMA missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler stEPSS 0.4%CVE-2024-9142CRITICALLocal File Inclusion (LFI) in Olgu Computer Systems' e-BelediyeEPSS 0.4%CVE-2025-62575HIGHMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceEPSS 0.4%CVE-2024-25646HIGHInformation Disclosure vulnerability in SAP BusinessObjects Web IntelligenceEPSS 0.4%CVE-2026-42497HIGHArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directoryEPSS 0.4%CVE-2025-66723HIGHinMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attaEPSS 0.4%CVE-2026-61186CRITICALVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version tEPSS 0.4%CVE-2024-41820MEDIUMCluster-level privilege escalation in kubeanEPSS 0.4%CVE-2025-31702MEDIUMA vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploiEPSS 0.4%CVE-2020-7337MEDIUMIncorrect Permission Assignment for Critical ResourceEPSS 0.4%CVE-2024-25644MEDIUMInformation Disclosure vulnerability in NetWeaver (WSRM)EPSS 0.4%CVE-2024-25645MEDIUMInformation Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)EPSS 0.4%CVE-2022-21819HIGHNVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker wiEPSS 0.4%CVE-2025-24009HIGHA vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). TheEPSS 0.4%