Fallos del tipo CWE-732

790 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2023-35841HIGHWinFlash Driver Permissions IssueEPSS 0.4%CVE-2025-24527HIGHAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connectoEPSS 0.4%CVE-2023-52715HIGHThe SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.4%CVE-2024-30413HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.4%CVE-2023-52388HIGHPermission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.4%CVE-2017-12713—An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. MultipEPSS 0.4%CVE-2020-10699HIGHA flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enEPSS 0.3%CVE-2025-55524HIGHInsecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.EPSS 0.3%CVE-2024-46881HIGHDevelocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduEPSS 0.3%CVE-2024-41970MEDIUMWAGO: Unauthorized Diagnostic Data Exposure in Multiple DevicesEPSS 0.3%CVE-2024-27108MEDIUMNon privileged access to critical file vulnerability in GE HealthCare EchoPAC productsEPSS 0.3%CVE-2024-28589MEDIUMAn issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbiEPSS 0.3%CVE-2020-10762—An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This EPSS 0.3%CVE-2026-9508CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStarEPSS 0.3%CVE-2019-3866MEDIUMAn information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were mEPSS 0.3%CVE-2019-18577MEDIUMDell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xEPSS 0.3%CVE-2024-37369HIGHRockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File PermissionsEPSS 0.3%CVE-2023-49582MEDIUMApache Portable Runtime (APR): Unexpected lax shared memory permissionsEPSS 0.3%CVE-2025-34135MEDIUMNagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit FilesEPSS 0.3%CVE-2024-47104MEDIUMIBM i incorrect privilege assignmentEPSS 0.3%