Falhas do tipo CWE-276

952 resultados

Permissões padrão incorretas

Ocorre quando um recurso (arquivo, diretório, registro, objeto) é criado com permissões padrão que são muito permissivas, permitindo acesso não autorizado. O código não define explicitamente permissões restritivas, deixando o sistema usar padrões inseguros que muitas vezes permitem leitura ou escrita por usuários não previstos.

Exemplo

Um aplicativo cria um arquivo de configuração com credenciais em /tmp/config.ini sem definir permissões — o sistema deixa o arquivo legível por qualquer usuário local (644), expondo senhas. Ou um diretório de upload recebe 777 como padrão, permitindo que qualquer pessoa execute scripts maliciosos nele.

Como mitigar

Sempre defina permissões explícitas e restritivas no momento da criação (umask 0077 para sensíveis, validar permissões em código). Para arquivos com secrets, use 0600 (apenas proprietário); para diretórios de aplicação, 0755 no máximo. Valide periodicamente permissões em produção e documente o modelo de acesso esperado.

CVE-2022-45552—An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive infEPSS 0.7%CVE-2024-34455HIGHBuildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. A fix was released in 2024.02.2.EPSS 0.7%CVE-2024-22409HIGHDefault Privileges allow for high level operations for low privileged users in datahubEPSS 0.7%CVE-2021-23166HIGHA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and wEPSS 0.6%CVE-2021-3187HIGHAn issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges bEPSS 0.6%CVE-2024-5967LOWKeycloak: leak of configured ldap bind credentials through the keycloak admin consoleEPSS 0.6%CVE-2025-24891CRITICALDumb Drop has an arbitrary file overwrite and path traversal for root shellEPSS 0.6%CVE-2022-46382HIGHRackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure PermissiEPSS 0.6%CVE-2022-42130MEDIUMThe Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3EPSS 0.6%CVE-2025-49144HIGHNotepad++ Privilege Escalation in Installer via Uncontrolled Executable Search PathEPSS 0.6%CVE-2021-4297MEDIUMtrampgeek jobe Restapi.php runs_post Privilege EscalationEPSS 0.6%CVE-2024-11088MEDIUMSimple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized ActorEPSS 0.6%CVE-2025-49843LOWconda-smithy Has Incorrect Default File PermissionsEPSS 0.6%CVE-2023-31116CRITICALAn issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. An incorrect default permission can cause uninteEPSS 0.6%CVE-2025-30706HIGHVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.0.0-9.2.EPSS 0.6%CVE-2025-27154HIGHSpotipy's cache file, containing spotify auth token, is created with overly broad permissionsEPSS 0.6%CVE-2022-22518MEDIUMA bug in the CODESYS V3 CmpUserMgr component fails to correctly apply a security policy.EPSS 0.6%CVE-2024-55225CRITICALAn issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including AdministratorEPSS 0.6%CVE-2020-13541CRITICALAn exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directoryEPSS 0.6%CVE-2023-43984—Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information froEPSS 0.6%