Falhas do tipo CWE-732

790 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2025-41118CRITICALSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionEPSS 0.4%CVE-2024-54910MEDIUMHasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.EPSS 0.4%CVE-2024-57068HIGHA prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS)EPSS 0.4%CVE-2026-26929MEDIUMApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataEPSS 0.4%CVE-2020-1736LOWA flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destEPSS 0.4%CVE-2023-1939MEDIUMNo access control for the OTP key on OTP entriesEPSS 0.4%CVE-2024-29078HIGHIncorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unautheEPSS 0.4%CVE-2020-15708CRITICALLibvirt Service Arbitrary File Write Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-40804CRITICALA vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoEPSS 0.4%CVE-2025-69426CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCEEPSS 0.4%CVE-2025-14988CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDAEPSS 0.4%CVE-2021-24703—Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin ActivationEPSS 0.4%CVE-2022-1316HIGHIncorrect Permission Assignment for Critical Resource in zerotier/zerotieroneEPSS 0.4%CVE-2024-11176MEDIUMIncorrect evaluation of effective permissions in M-Files AinoEPSS 0.4%CVE-2026-20693MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26EPSS 0.4%CVE-2026-62195HIGHOpenClaw 2026.5.20 < 2026.6.6 Authorization Bypass via MCP loopbackEPSS 0.4%CVE-2024-55411HIGHAn issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via suEPSS 0.4%CVE-2023-32162HIGHWacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-45471HIGHInsecure permissions in measure-cold-start v1.4.1 allows attackers to escalate privileges and compromise the customer cloud account.EPSS 0.4%CVE-2025-4609CRITICALIncorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attackerEPSS 0.4%