Falhas do tipo CWE-276

953 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2022-23454HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2022-44548MEDIUMThere is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may EPSS 0.2%CVE-2022-23453HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2026-48935LOWA flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-reaEPSS 0.2%CVE-2023-4088CRITICALMalicious Code Execution Vulnerability in FA Engineering Software ProductsEPSS 0.2%CVE-2023-3116HIGHLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2025-54530HIGHIn JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissionsEPSS 0.2%CVE-2022-36367MEDIUMIncorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentiallEPSS 0.2%CVE-2025-24915HIGHWhen installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permiEPSS 0.2%CVE-2023-35181HIGHSolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2024-29962MEDIUMInsecure file permission setting that makes files world-readableEPSS 0.2%CVE-2024-10469MEDIUMCERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.EPSS 0.2%CVE-2023-38295HIGHCertain software builds for the TCL 30Z and TCL 10 Android devices contain a vulnerable, pre-installed app that relies on a missing permissiEPSS 0.2%CVE-2022-43701HIGHInsecure directory permissions on installer filesEPSS 0.2%CVE-2024-46464HIGHIn PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host EPSS 0.2%CVE-2022-4575MEDIUM A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attackerEPSS 0.2%CVE-2025-31261MEDIUMA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOEPSS 0.2%CVE-2023-27392MEDIUMIncorrect default permissions in the Intel(R) Support android application before version v23.02.07 may allow a privileged user to potentiallEPSS 0.2%CVE-2025-49842LOWconda-forge-webservices Privilege Escalation Risk via Default Docker Root UserEPSS 0.2%CVE-2025-29504HIGHInsecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.EPSS 0.2%