Falhas do tipo CWE-552

365 resultados

Arquivos ou diretórios acessíveis a terceiros

A aplicação ou servidor expõe arquivos ou diretórios com permissões insuficientes, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo sensível. O risco varia desde exposição de dados confidenciais até execução de código malicioso, dependendo do que está exposto e das permissões concedidas.

Exemplo

Um servidor web servindo a pasta /uploads com permissões 777, onde backup de banco de dados ou chaves privadas ficam armazenadas. Qualquer pessoa com acesso à rede (ou internet, se o servidor estiver exposto) consegue baixar esses arquivos. Outro cenário: arquivo de configuração com credenciais legível por todos em /etc/app/config.txt.

Como mitigar

Implemente o princípio do menor privilégio: defina permissões de arquivo e diretório restritivas (ex: 640, 750), revise listas de controle de acesso (ACLs), separe dados sensíveis de diretórios servidos publicamente, e audite regularmente permissões em produção usando ferramentas de varredura (find, stat, ou análise de ACLs).

CVE-2021-47960MEDIUMA files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to EPSS 0.2%CVE-2026-85175HIGHSiYuan before v3.8.2 TLS Private Key Disclosure via getFileEPSS 0.2%CVE-2026-14849LOWPaid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export FilesEPSS 0.2%CVE-2023-4475HIGHAn Arbitrary File Movement vulnerability was found on the ADMEPSS 0.2%CVE-2025-44779MEDIUMAn issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull.EPSS 0.2%CVE-2023-29820MEDIUMAn issue found in Webroot SecureAnywhere Endpoint Protection CE 23.1 v.9.0.33.39 and before allows a local attacker to access sensitive infoEPSS 0.2%CVE-2025-23276HIGHNVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulEPSS 0.2%CVE-2025-30103MEDIUMDell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A lEPSS 0.2%CVE-2023-29080HIGHPrivilege escalation in InstallShieldEPSS 0.2%CVE-2024-10526HIGHRapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceEPSS 0.2%CVE-2025-49797HIGHMultiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be execuEPSS 0.2%CVE-2025-59054HIGHdstack has insecure LUKS2 persistent storage partitions that may be opened and usedEPSS 0.2%CVE-2025-25267MEDIUMA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (AllEPSS 0.2%CVE-2026-73735MEDIUMAuthenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer APIEPSS 0.2%CVE-2026-35169HIGHLORIS has potential cross-site scripting in help_editor moduleEPSS 0.2%CVE-2025-13225MEDIUMTanium addressed an arbitrary file deletion vulnerability in TanOS.EPSS 0.2%CVE-2024-48838LOWDell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External EPSS 0.2%CVE-2025-25266HIGHA vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (AllEPSS 0.2%CVE-2025-3025HIGHCCleaner Link Following Local Privilege Escalation VulnerabilityEPSS 0.1%CVE-2024-54099MEDIUMFile replacement vulnerability on some devices Impact: Successful exploitation of this vulnerability will affect integrity and confidentialiEPSS 0.1%