Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2022-36122HIGHThe Automox Agent before 40 on Windows incorrectly sets permissions on key files.EPSS 0.2%CVE-2023-3282MEDIUMCortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR EngineEPSS 0.2%CVE-2024-0128HIGHNVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A suEPSS 0.2%CVE-2024-6780LOWImproper permission control in com.android.server.telecomEPSS 0.2%CVE-2022-41699HIGHIncorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticatEPSS 0.2%CVE-2023-52554MEDIUMPermission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect service confidentEPSS 0.2%CVE-2025-2098HIGHDylib Hijacking in Fast CAD ReaderEPSS 0.2%CVE-2026-59946MEDIUMComposer: Path traversal in package bin field lets dependencies chmod arbitrary host filesEPSS 0.2%CVE-2025-43268HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A malicious app may be able to gaEPSS 0.2%CVE-2025-30408MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoEPSS 0.2%CVE-2026-64707MEDIUMA permissions issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6,EPSS 0.2%CVE-2025-30661HIGHJunos OS: Low-privileged user can cause script to run as root, leading to privilege escalationEPSS 0.2%CVE-2025-36537HIGHIncorrect Permission Assignment for Critical Resource in TeamViewer Remote ManagementEPSS 0.2%CVE-2025-14979HIGHEddie VPN 2.24.6 - Local Privilege EscalationEPSS 0.2%CVE-2025-52923MEDIUMSangfor aTrust through 2.4.10 allows users to modify the ExecStartPre command.EPSS 0.2%CVE-2024-28827HIGHPrivilege escalation in Windows agentEPSS 0.2%CVE-2026-63358HIGHFileGator privilege escalationEPSS 0.2%CVE-2023-28960HIGHJunos OS Evolved: Docker repository is world-writeable, allowing low-privileged local user to inject files into Docker containersEPSS 0.2%CVE-2019-25344HIGHMobileGo 8.5.0 - Insecure File PermissionsEPSS 0.2%CVE-2026-65069MEDIUMData::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.2%