Falhas do tipo CWE-732

856 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2025-25373CRITICALThe Memory Management Module of NASA cFS (Core Flight System) Aquila has insecure permissions, which can be exploited to gain an RCE on the EPSS 0.5%CVE-2024-12255MEDIUMAccept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information ExposureEPSS 0.5%CVE-2025-21564HIGHVulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Agile Integration Services). The supported versEPSS 0.5%CVE-2026-63358HIGHFileGator privilege escalationEPSS 0.5%CVE-2025-34206CRITICALVasion Print (formerly PrinterLogic) Insecure Shared Storage PermissionsEPSS 0.5%CVE-2024-5163CRITICALImproper permission settings in com.transsion.carlcareEPSS 0.5%CVE-2026-73664HIGHFreePBX: Authenticated Arbitrary SSH Key Injection via Backup ModuleEPSS 0.5%CVE-2023-30512MEDIUMCubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thEPSS 0.5%CVE-2026-61892HIGHWeintek cMT3092X Incorrect Permission Assignment for Critical ResourceEPSS 0.5%CVE-2023-32979MEDIUMJenkins Email Extension Plugin does not perform a permission check in a method implementing form validation, allowing attackers with OverallEPSS 0.5%CVE-2022-33163MEDIUMIBM Security Directory Suite VA information disclosureEPSS 0.5%CVE-2024-10018CRITICALImproper permission control in the mobile application (com.transsion.aivoiceassistant) can lead to the launch of any unexported component.EPSS 0.5%CVE-2022-45193MEDIUMCBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.EPSS 0.5%CVE-2025-3944HIGHIncorrect Permission Assignment for Critical ResourceEPSS 0.5%CVE-2026-13673HIGHAn incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-EPSS 0.5%CVE-2022-30354HIGHOvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. AuthenticatiEPSS 0.5%CVE-2026-61155CRITICALVulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version EPSS 0.5%CVE-2025-20387HIGHIncorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgradeEPSS 0.5%CVE-2022-40817MEDIUMZammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents were still wrongly abEPSS 0.5%CVE-2025-20386HIGHIncorrect permission assignment on Splunk Enterprise for Windows during new installation or upgradeEPSS 0.5%