Fallos del tipo CWE-732

792 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2026-50544MEDIUMNortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure PermissionsEPSS 0.1%CVE-2025-0164LOWIBM QRadar SIEM information disclosureEPSS 0.1%CVE-2026-50590MEDIUMIn Mimecast Incydr before 2.6.0, arbitrary file access can occur.EPSS 0.1%CVE-2025-38742MEDIUMDell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.EPSS 0.1%CVE-2026-7480HIGHAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate priviEPSS 0.1%CVE-2025-53396HIGHIncorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whiEPSS 0.1%CVE-2024-6510HIGHLocal privilege escalation vulnerability in AVG Internet SecurityEPSS 0.1%CVE-2026-14208HIGHLocal Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0EPSS 0.1%CVE-2026-20092MEDIUMCisco Intersight Virtual Appliance Privilege Escalation VulnerabilityEPSS 0.1%CVE-2025-64642HIGHMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2025-54545HIGHOn affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.EPSS 0.1%CVE-2024-32010HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extrEPSS 0.1%CVE-2026-33271MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before builEPSS 0.1%CVE-2025-20233LOWIncorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File EditingEPSS 0.1%CVE-2025-67794HIGHAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the aEPSS 0.1%CVE-2025-68462LOWFreedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.EPSS 0.1%CVE-2025-11790MEDIUMCredentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentEPSS 0.1%CVE-2025-59349LOWDirectories created via os.MkdirAll are not checked for permissionsEPSS 0.1%CVE-2026-8070HIGHIncorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, reEPSS 0.1%CVE-2019-25343HIGHNextVPN 4.10 - Insecure File PermissionsEPSS 0.1%