Falhas do tipo CWE-281

231 resultados

Preservação inadequada de permissões

Quando um programa cria, copia ou modifica arquivos e recursos, mas não mantém ou herda as permissões originais corretamente, permitindo acesso indevido. Isso expõe dados sensíveis ou permite que usuários não autorizados executem operações críticas.

Exemplo

Um backup que copia arquivos de configuração com credenciais, mas muda as permissões para leitura por qualquer usuário do sistema. Ou um instalador que cria diretórios temporários com permissões padrão abertas, deixando senhas de sessão visíveis para outros usuários locais.

Como mitigar

Sempre defina explicitamente permissões restritivas (ex: 0600 para arquivos sensíveis) logo após criar ou copiar arquivos. Use funções seguras da plataforma (chmod, SetSecurityDescriptor) e valide que as permissões foram aplicadas corretamente antes de escrever dados sensíveis.

CVE-2023-52542MEDIUMPermission verification vulnerability in the system module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2023-25809MEDIUMrootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runcEPSS 0.3%CVE-2023-52373HIGHVulnerability of permission verification in the content sharing pop-up module.Successful exploitation of this vulnerability may cause unauthEPSS 0.3%CVE-2025-14779LOWImproper Access Control via Secret Type Management API in WSO2 Identity ServerEPSS 0.3%CVE-2026-44832HIGHSnipe-IT: Privilege Escalation via API Permissions AssignmentEPSS 0.3%CVE-2025-27703HIGHPrivilege escalation in the management console of Absolute Secure Access prior to version 13.54EPSS 0.3%CVE-2024-39902MEDIUMTuleap's recursive permissions to document manager folder are not properly appliedEPSS 0.3%CVE-2024-50930HIGHAn issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.EPSS 0.3%CVE-2021-41089LOW`docker cp` allows unexpected chmod of host filesEPSS 0.3%CVE-2023-2993MEDIUMA valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limEPSS 0.3%CVE-2023-32355—A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS VenturEPSS 0.3%CVE-2024-53994MEDIUMPotential bypass of chat permissions in DiscourseEPSS 0.3%CVE-2026-40767HIGHWordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-44223MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to aEPSS 0.3%CVE-2022-31608HIGHNVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabiliEPSS 0.3%CVE-2024-3545MEDIUMImproper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and DEPSS 0.3%CVE-2022-48296MEDIUMThe SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasEPSS 0.3%CVE-2025-21541MEDIUMVulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and Grants UI). Supported versions that aEPSS 0.3%CVE-2024-40824HIGHThis issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, wEPSS 0.3%CVE-2023-28647MEDIUMApp pin of the iOS app can be bypassed in Nextcloud iOSEPSS 0.3%