Falhas do tipo CWE-281

225 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2024-44188MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protecEPSS 0.2%CVE-2023-43612HIGHHiview has an improper preservation of permissions vulnerabilityEPSS 0.2%CVE-2024-36062MEDIUMThe com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no peEPSS 0.2%CVE-2025-14779LOWImproper Access Control via Secret Type Management API in WSO2 Identity ServerEPSS 0.2%CVE-2024-40859MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sEPSS 0.2%CVE-2024-27858MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protecEPSS 0.2%CVE-2026-88016HIGHrclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationEPSS 0.2%CVE-2024-3289HIGHWhen installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secEPSS 0.2%CVE-2024-27888HIGHA permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in macOS Sonoma 14.4. An appEPSS 0.2%CVE-2024-3291HIGHPrivilege EscalationEPSS 0.2%CVE-2025-8325MEDIUMImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsEPSS 0.2%CVE-2026-58494MEDIUMWasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationEPSS 0.2%CVE-2023-0975HIGH A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, toEPSS 0.2%CVE-2024-53934HIGHThe com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enablesEPSS 0.2%CVE-2024-46941MEDIUMSystemUI component protection settings vulnerabilityEPSS 0.2%CVE-2025-9615LOWNetworkmanager: networkmanager file accessEPSS 0.2%CVE-2023-31926HIGHArbitrary File Overwrite using less commandEPSS 0.2%CVE-2024-54516LOWA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may bEPSS 0.2%CVE-2023-2818MEDIUMITM Windows Agent Insecure Filesystem PermissionsEPSS 0.2%CVE-2026-24194HIGHNVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handliEPSS 0.2%