Falhas do tipo CWE-281

232 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2024-10458MEDIUMA permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects EPSS 0.6%CVE-2024-55507CRITICALAn issue in CodeAstro Complaint Management System v.1.0 allows a remote attacker to escalate privileges via the delete_e.php component.EPSS 0.6%CVE-2023-32552—An Improper access control vulnerability in Trend Micro Apex One and Apex One as a Service could allow an unauthenticated user under certainEPSS 0.6%CVE-2023-28161HIGHIf temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permisEPSS 0.6%CVE-2024-54465HIGHA logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileEPSS 0.6%CVE-2024-46622CRITICALAn Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8EPSS 0.6%CVE-2024-57439MEDIUMAn issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicEPSS 0.6%CVE-2023-35938MEDIUMUser access not updated with privilege change in TuleapEPSS 0.6%CVE-2024-22114MEDIUMSystem Information Widget in Global View Dashboard exposes information about Hosts to Users without PermissionEPSS 0.6%CVE-2022-24428MEDIUMDell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A reEPSS 0.6%CVE-2026-35385HIGHIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the EPSS 0.6%CVE-2023-6239MEDIUMIncorrect calculation of effective permissionsEPSS 0.6%CVE-2023-25817LOWDelete permissions are not saved when creating public share in Nextcloud serverEPSS 0.6%CVE-2024-28152MEDIUMIn Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests fEPSS 0.6%CVE-2022-47547MEDIUMGossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though itEPSS 0.6%CVE-2024-44149HIGHA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protecEPSS 0.6%CVE-2024-53355HIGHMultiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low EPSS 0.5%CVE-2024-4768MEDIUMA bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulneEPSS 0.5%CVE-2022-31096MEDIUMInvites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in DiscourseEPSS 0.5%CVE-2024-54818HIGHSourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list.EPSS 0.5%