Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2026-89282CRITICALCVE-2026-89282EPSS 0.2%CVE-2021-36279HIGHDell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could EPSS 0.2%CVE-2023-6179HIGHIncorrect Permission assignment to program executable foldersEPSS 0.2%CVE-2025-57392HIGHBenimPOS Masaustu 3.0.x is affected by insecure file permissions. The application installation directory grants Everyone and BUILTIN\Users gEPSS 0.2%CVE-2023-47712HIGHIBM Security Guardium privilege escalationEPSS 0.2%CVE-2024-32478MEDIUMGit Credential Manager (GCM)'s Debian package does not set root ownership on installed filesEPSS 0.2%CVE-2021-36290MEDIUMDell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially expEPSS 0.2%CVE-2020-5358MEDIUMDell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability dEPSS 0.2%CVE-2024-20456MEDIUMA vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass theEPSS 0.2%CVE-2022-2332MEDIUMHoneywell SoftMaster Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2025-13941HIGHFoxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-52094HIGHInsecure Permissions vulnerability in PDQ Smart Deploy V.3.0.2040 allows a local attacker to execute arbtirary code via the \HKLM\SYSTEM\SetEPSS 0.2%CVE-2025-1067HIGHThere is a code injection vulnerability in ArcGIS ProEPSS 0.2%CVE-2022-22248HIGHJunos OS Evolved: Incorrect file permissions can allow low-privileged user to cause another user to execute arbitrary commandsEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2026-42058MEDIUMBIG-IP iControl REST vulnerabilityEPSS 0.2%CVE-2021-34758MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilityEPSS 0.2%CVE-2025-21551MEDIUMVulnerability in the Oracle Solaris product of Oracle Systems (component: File system). The supported version that is affected is 11. EasiEPSS 0.2%CVE-2026-55441HIGHmise: Arbitrary command execution via task-include files in an untrusted, config-less repositoryEPSS 0.2%CVE-2024-38864MEDIUMUser-Readable Private Key in Windows AgentEPSS 0.2%