Fallos del tipo CWE-732

790 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2023-3322HIGH Code Execution through overwriting service executable in utilities directoryEPSS 0.3%CVE-2024-1724MEDIUMsnapd allows $HOME/bin symlinkEPSS 0.3%CVE-2019-2389MEDIUMProcess termination via PID file manipulationEPSS 0.3%CVE-2026-76372MEDIUMIncorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAREPSS 0.3%CVE-2025-21520LOWVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.40 andEPSS 0.3%CVE-2024-23223MEDIUMA privacy issue was addressed with improved handling of files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3EPSS 0.3%CVE-2025-27216HIGHMultiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to eEPSS 0.3%CVE-2025-0374MEDIUMUnprivileged access to system filesEPSS 0.3%CVE-2025-22454HIGHInsufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their EPSS 0.3%CVE-2026-0775HIGHnpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2024-39709HIGHIncorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version EPSS 0.3%CVE-2022-34891HIGHThis vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. AnEPSS 0.3%CVE-2012-0433LOWinsecure permissions on files containing confidential dataEPSS 0.3%CVE-2026-82697MEDIUMsambitraj Student-Management-System session_start cookie httponly flagEPSS 0.3%CVE-2009-3482HIGHTrustPort Antivirus before 2.8.0.2266 and PC Security before 2.0.0.1291 use weak permissions (Everyone: Full Control) for files under %PROGREPSS 0.3%CVE-2020-8473HIGHABB System 800xA Weak File Permissions - ABB System 800xA BaseEPSS 0.3%CVE-2020-8029LOWskuba: Insecure handling of private keyEPSS 0.3%CVE-2025-20298HIGHIncorrect permission assignment on Universal Forwarder for Windows during new installation or upgradeEPSS 0.3%CVE-2025-21571HIGHVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PrioEPSS 0.3%CVE-2019-0073MEDIUMJunos OS: PKI key pairs are exported with insecure file permissionsEPSS 0.3%