Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2025-40672HIGHPrivilege Escalation in Panloader.exeEPSS 0.2%CVE-2026-26101HIGHIncorrect Permission Assignment for Critical Resource in Owl opdsEPSS 0.2%CVE-2026-26102HIGHIncorrect Permission Assignment for Critical Resource in Owl opdsEPSS 0.2%CVE-2026-47134MEDIUMClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policyEPSS 0.2%CVE-2022-43309MEDIUMSupermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.EPSS 0.2%CVE-2025-62688MEDIUMAutomationDirect Productivity Suite Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2025-64699HIGHAn incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privilEPSS 0.2%CVE-2026-54447HIGHgarminconnect: Insecure Permission Assignment for Garmin OAuth Token StoreEPSS 0.2%CVE-2023-33251MEDIUMWhen Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has toEPSS 0.2%CVE-2025-0758MEDIUMHitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2026-65065MEDIUMData::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2024-49385MEDIUMSensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) beforEPSS 0.1%CVE-2026-14478HIGHIncorrect Permission Assignment in Autodesk Installer Named PipesEPSS 0.1%CVE-2026-41288HIGHWatchGuard Agent on Windows Privilege Escalation VulnerabilityEPSS 0.1%CVE-2026-33430HIGHBriefcase: Windows MSI Installer Privilege Escalation via Insecure Directory PermissionsEPSS 0.1%CVE-2026-80112HIGHPassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sysEPSS 0.1%CVE-2025-23403HIGHA vulnerability has been identified in SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions). The affected device do nEPSS 0.1%CVE-2023-38640MEDIUMA vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific fiEPSS 0.1%CVE-2026-78604HIGHIncorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEMEPSS 0.1%CVE-2026-48790MEDIUMturso-cli persists Turso platform JWT with world-readable (0o644) file permissionsEPSS 0.1%