Falhas do tipo CWE-281

225 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2021-20263—A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capabilitEPSS 0.4%CVE-2023-22738MEDIUMImproper Preservation of Permissions in vantage6EPSS 0.4%CVE-2024-56317HIGHIn Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then atteEPSS 0.4%CVE-2026-39828MEDIUMInvoking bypass of certificate restrictions in golang.org/x/crypto/sshEPSS 0.4%CVE-2025-22620MEDIUMgix-worktree-state nonexclusive checkout sets executable files world-writableEPSS 0.4%CVE-2026-34744MEDIUMMantisBT authorization bypass allows continued access to self-uploaded attachments on private issuesEPSS 0.4%CVE-2024-50928MEDIUMInsecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devicesEPSS 0.4%CVE-2024-43784MEDIUMRe-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletionEPSS 0.4%CVE-2025-32696NONE"reupload-own" restriction can be bypassed by reverting fileEPSS 0.4%CVE-2023-28642MEDIUMAppArmor bypass with symlinked /proc in runcEPSS 0.3%CVE-2024-40800HIGHAn input validation issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macEPSS 0.3%CVE-2024-56178MEDIUMAn issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group EPSS 0.3%CVE-2026-61709MEDIUMOpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that userEPSS 0.3%CVE-2023-42231HIGHPat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users byEPSS 0.3%CVE-2022-48295HIGHThe IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (baEPSS 0.3%CVE-2022-48301HIGHThe bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-iEPSS 0.3%CVE-2024-23560MEDIUMHCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type EPSS 0.3%CVE-2023-52542MEDIUMPermission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2023-52373HIGHVulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthEPSS 0.3%CVE-2023-25809MEDIUMrootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runcEPSS 0.3%