Fallos del tipo CWE-732

791 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2023-42489HIGH EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical ResourceEPSS 0.7%CVE-2026-73664HIGHFreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleEPSS 0.7%CVE-2023-40622CRITICALInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)EPSS 0.7%CVE-2022-1596MEDIUMABB Relion REX640 Insufficient file access controlEPSS 0.6%CVE-2021-3172HIGHAn issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feEPSS 0.6%CVE-2024-21431HIGHHypervisor-Protected Code Integrity (HVCI) Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2023-35147MEDIUMJenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowiEPSS 0.6%CVE-2022-36800MEDIUMAffected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse Users" permission tEPSS 0.6%CVE-2025-11921HIGHiStat Menus 7.10.4 - Local Privilege EscalationEPSS 0.6%CVE-2025-34025HIGHVersa Concerto Insecure Docker Mount Container EscapeEPSS 0.6%CVE-2024-12149HIGHIncorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on WindEPSS 0.6%CVE-2026-19583CRITICALVelociraptor Required Permissions bypass by using client monitoring queriesEPSS 0.6%CVE-2026-44878HIGHAuthenticated Path Traversal allows Unauthorized Access in Web InterfaceEPSS 0.6%CVE-2023-32114LOWDenial of Service in SAP NetWeaverEPSS 0.6%CVE-2023-32724CRITICALJavaScript engine memory pointers are directly available for Zabbix users for modificationEPSS 0.6%CVE-2023-4332—Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log fileEPSS 0.6%CVE-2024-45497HIGHOpenshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentialsEPSS 0.6%CVE-2025-0066CRITICALInformation Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)EPSS 0.6%CVE-2023-32990MEDIUMA missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toEPSS 0.6%CVE-2022-23143MEDIUMZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high peEPSS 0.6%