Falhas do tipo CWE-377

108 resultados

Arquivo temporário inseguro

A aplicação cria arquivos temporários de forma previsível ou sem proteção adequada de permissões, permitindo que um atacante leia, modifique ou substitua o arquivo antes que a aplicação o use. Isso pode expor dados sensíveis ou levar a execução de código malicioso.

Exemplo

Um programa de backup cria um arquivo temporário com nome fixo como `/tmp/backup_dados.tmp` ou `/tmp/app123.tmp` sem definir permissões restritivas. Um atacante em sistema compartilhado cria um link simbólico apontando para um arquivo crítico, fazendo a aplicação sobrescrever permissões ou dados importantes.

Como mitigar

Use APIs seguras para criar arquivos temporários (como `mkstemp()` em C, `tempfile` em Python ou `Files.createTempFile()` em Java) que geram nomes aleatórios e definem permissões restritas automaticamente. Evite caminhos fixos e prefixos previsíveis, e sempre valide se o arquivo foi criado apenas pela aplicação.

CVE-2024-2313LOWIf kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use thEPSS 0.2%CVE-2024-34490MEDIUMIn Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. Thus, the contents may be controllEPSS 0.2%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.2%CVE-2026-4822HIGHEnter Software Iperius Backup Backup Service temp fileEPSS 0.2%CVE-2026-46406MEDIUMClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File WriteEPSS 0.2%CVE-2022-34387MEDIUM Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilEPSS 0.2%CVE-2026-63404HIGHFaktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)EPSS 0.2%CVE-2025-61659MEDIUMbash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2025-9474LOWMihomo Party Socket sysproxy.ts enableSysProxy temp fileEPSS 0.1%CVE-2026-40973HIGHA local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seEPSS 0.1%CVE-2026-20618MEDIUMAn issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access userEPSS 0.1%CVE-2021-22572MEDIUMData-transfer-project information disclosure via tmp directoryEPSS 0.1%CVE-2026-35342LOWuutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIREPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%CVE-2025-46369HIGHDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2015-0849LOWpycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.EPSS 0.1%CVE-2025-46368MEDIUMDell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged aEPSS 0.1%CVE-2026-25701HIGHAn Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects likeEPSS 0.1%