Falhas do tipo CWE-277

71 resultados

Permissões Herdadas Inseguras

Ocorre quando um recurso (arquivo, diretório, chave de registro, objeto) herda permissões de seu container pai de forma insegura, deixando-o acessível a usuários ou processos não autorizados. O desenvolvedor assume que as permissões padrão do pai são adequadas, mas muitas vezes são excessivamente permissivas ou inadequadas para o contexto de segurança da aplicação.

Exemplo

Uma aplicação cria um arquivo de configuração com credenciais dentro de um diretório que herda permissões 'leitura para todos'. Qualquer usuário do sistema consegue ler o arquivo e extrair as credenciais, mesmo que o arquivo em si nunca tenha tido suas permissões explicitamente definidas.

Como mitigar

Sempre defina permissões explícitas no recurso criado, sem depender de herança. No código, use chamadas específicas de ACL (como chmod, SetFileSecurity no Windows ou APIs equivalentes) para garantir que apenas o proprietário ou processos autorizados tenham acesso, independente das permissões do diretório pai.

CVE-2025-56019MEDIUMAn insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to coEPSS 0.3%CVE-2025-36104MEDIUMIBM Storage Scale information disclosureEPSS 0.3%CVE-2025-64185MEDIUMOpen OnDemand RPM packages create world writable locationsEPSS 0.3%CVE-2025-9039MEDIUMInformation Disclosure in Amazon ECS Container AgentEPSS 0.3%CVE-2023-29065MEDIUMOverly Permissive Access PolicyEPSS 0.3%CVE-2020-5343HIGHDell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissEPSS 0.3%CVE-2025-22448MEDIUMInsecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user toEPSS 0.3%CVE-2024-36691MEDIUMInsecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify usersEPSS 0.3%CVE-2025-65111LOWSpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete ResultsEPSS 0.2%CVE-2024-27847HIGHThis issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS MontereyEPSS 0.2%CVE-2024-23233HIGHThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to thiEPSS 0.2%CVE-2018-25111MEDIUMdjango-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.EPSS 0.2%CVE-2024-27848HIGHThis issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A maliciousEPSS 0.2%CVE-2024-29417HIGHInsecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password resEPSS 0.2%CVE-2024-27825HIGHA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS EPSS 0.2%CVE-2025-20008MEDIUMInsecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow a privileged user to potEPSS 0.2%CVE-2023-45736MEDIUMInsecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enaEPSS 0.2%CVE-2023-39230MEDIUMInsecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user EPSS 0.2%CVE-2023-34314MEDIUMInsecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentiallEPSS 0.2%CVE-2024-45599LOWTCC Bypass in Cursor's macOS ApplicationEPSS 0.2%