Falhas do tipo CWE-732

873 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2024-3668HIGHPowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege EscalationEPSS 0.4%CVE-2026-87988CRITICALAn arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unEPSS 0.4%CVE-2026-118131CRITICALCVE-2026-118131EPSS 0.4%CVE-2018-14650MEDIUMIt was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tEPSS 0.4%CVE-2023-33004MEDIUMA missing permission check in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers with Overall/Read permission to reset profiler stEPSS 0.4%CVE-2025-24009HIGHA vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). TheEPSS 0.4%CVE-2023-31238MEDIUMA vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM P850 (7KG8500-0AA00-2AA0) (All versionsEPSS 0.4%CVE-2024-8900HIGHAn attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnEPSS 0.4%CVE-2024-54910MEDIUMHasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.EPSS 0.4%CVE-2026-26929MEDIUMApache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks MetadataEPSS 0.4%CVE-2024-9142CRITICALLocal File Inclusion (LFI) in Olgu Computer Systems' e-BelediyeEPSS 0.4%CVE-2026-54381HIGHVitaFit Cloud API Storage Bucket Unauthenticated Access Information DisclosureEPSS 0.4%CVE-2024-25646HIGHInformation Disclosure vulnerability in SAP BusinessObjects Web IntelligenceEPSS 0.4%CVE-2026-48499CRITICALActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheEPSS 0.4%CVE-2024-41820MEDIUMCluster-level privilege escalation in kubeanEPSS 0.4%CVE-2026-61186CRITICALVulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install). The supported version tEPSS 0.4%CVE-2025-40804CRITICALA vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected application exposes a netwoEPSS 0.4%CVE-2020-7337MEDIUMIncorrect Permission Assignment for Critical ResourceEPSS 0.4%CVE-2026-20693MEDIUMThis issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26EPSS 0.4%CVE-2025-66723HIGHinMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attaEPSS 0.4%