Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2026-23648HIGHGlory RBG-100 Recycler System Local Privilege Escalation via Insecure File PermissionsEPSS 0.1%CVE-2026-27788HIGHIncorrect permission assignment for critical resource issue exists in ServerView Agents for Windows V11.60.04 and earlier. If this vulnerabiEPSS 0.1%CVE-2026-60659HIGHVulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). The supported version that is affected is 11.4. EaEPSS 0.1%CVE-2025-0046HIGHIncorrect directory permissions could allow a local user to escalate their privileges, potentially resulting in arbitrary code execution.EPSS 0.1%CVE-2024-6619HIGHIncorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream ReportEPSS 0.1%CVE-2026-50602HIGHPlanet9 Incorrect Permission Assignment Vulnerability InformationEPSS 0.1%CVE-2026-48722MEDIUMNextflow: Incorrect default permissions in the nextflow auth login commandEPSS 0.1%CVE-2024-45657MEDIUMIBM Security Verify Access incorrect privilege assignmentEPSS 0.1%CVE-2026-65066LOWData::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-84828MEDIUMPcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --tokenEPSS 0.1%CVE-2024-10228LOWVagrant VMWare Utility installation files vulnerable to modification by unprivileged userEPSS 0.1%CVE-2026-64616LOWData::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-64615LOWData::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65063LOWData::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65064LOWData::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65067LOWData::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65062LOWData::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65061LOWData::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-64617LOWData::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%CVE-2026-65068LOWData::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOWEPSS 0.1%