Falhas do tipo CWE-276

980 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2025-57850MEDIUMCodeready-ws: privilege escalation via excessive /etc/passwd permissionsEPSS 0.2%CVE-2021-3722MEDIUMA denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be wEPSS 0.2%CVE-2025-24790MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissionsEPSS 0.2%CVE-2025-8069HIGHLocal Privilege Escalation Vulnerability in AWS Client VPN Windows ClientEPSS 0.2%CVE-2022-26855MEDIUMDell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentiEPSS 0.2%CVE-2022-27500MEDIUMIncorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enEPSS 0.2%CVE-2021-44470MEDIUMIncorrect default permissions for the Intel(R) Connect M Android application before version 1.7.4 may allow an authenticated user to potentiEPSS 0.2%CVE-2025-62577HIGHETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to EPSS 0.2%CVE-2022-26344HIGHIncorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enEPSS 0.2%CVE-2024-50590HIGHLocal Privilege Escalation via Weak Service Binary PermissionsEPSS 0.2%CVE-2023-42774MEDIUMLiteos-A has a incorrect default permissions vulnerabilityEPSS 0.2%CVE-2022-4568HIGHA directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.EPSS 0.2%CVE-2025-24915HIGHWhen installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permiEPSS 0.2%CVE-2024-51440HIGHAn issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.EPSS 0.2%CVE-2024-8037MEDIUMVulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with acEPSS 0.2%CVE-2026-100718HIGHFroxlor before 2.3.12 Authentication Bypass via EmailSender.addEPSS 0.2%CVE-2025-31261MEDIUMA permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOEPSS 0.2%CVE-2022-23454HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%CVE-2025-8766MEDIUMNoobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core containerEPSS 0.2%CVE-2022-23453HIGHPotential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromEPSS 0.2%