Fallos del tipo CWE-732

787 resultados

Permissões inadequadas em recurso crítico de segurança

A aplicação ou sistema define permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários não autorizados leiam ou modifiquem dados sensíveis. Isso expõe segredos (chaves API, senhas, tokens), permite alteração de configurações críticas ou compromete a integridade do sistema.

Ejemplo

Um arquivo de configuração contendo credenciais de banco de dados é criado com permissões 644 (leitura global) em vez de 600, permitindo que qualquer usuário do sistema leia as credenciais. Ou um diretório com chaves privadas SSH é criado com permissões 777, deixando-o acessível e modificável por todos.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask 0077 para arquivos sensíveis, chmod 600 para segredos). Revise e audite permissões de recursos críticos regularmente, especialmente após deploy. Use controle de acesso baseado em papéis (RBAC) e aplique o princípio do menor privilégio.

CVE-2024-57547HIGHInsecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the FEPSS 0.6%CVE-2023-27095MEDIUMInsecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UsEPSS 0.6%CVE-2023-32723HIGHInefficient permission check in class CControllerAuthenticationUpdateEPSS 0.6%CVE-2024-7986MEDIUMRockwell Automation ThinManager® ThinServer™ Information DisclosureEPSS 0.6%CVE-2023-24626MEDIUMsocket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows locaEPSS 0.5%CVE-2022-1655—An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are createdEPSS 0.5%CVE-2025-46093CRITICALLiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as EPSS 0.5%CVE-2025-26469CRITICALAn incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3EPSS 0.5%CVE-2025-58372HIGHRoo Code: Potential Remote Code Execution via .code-workspaceEPSS 0.5%CVE-2022-22521HIGHPrivilege Escalation in Miele Benchmark Programming ToolEPSS 0.5%CVE-2025-3944HIGHIncorrect Permission Assignment for Critical ResourceEPSS 0.5%CVE-2025-45150CRITICALInsecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplyingEPSS 0.5%CVE-2022-42949HIGHSilverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.EPSS 0.5%CVE-2023-22326MEDIUMiControl REST and tmsh vulnerabilityEPSS 0.5%CVE-2024-29964MEDIUMBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesEPSS 0.5%CVE-2024-12255MEDIUMAccept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information ExposureEPSS 0.5%CVE-2026-29516MEDIUMBuffalo TeraStation TS5400R Excessive File Permissions Information DisclosureEPSS 0.5%CVE-2024-5163CRITICALImproper permission settings in com.transsion.carlcareEPSS 0.5%CVE-2025-34206CRITICALVasion Print (formerly PrinterLogic) Insecure Shared Storage PermissionsEPSS 0.5%CVE-2023-30512MEDIUMCubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thEPSS 0.5%