Falhas do tipo CWE-732

790 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2023-35841HIGHWinFlash Driver Permissions IssueEPSS 0.4%CVE-2025-24527HIGHAn issue was discovered in Akamai Enterprise Application Access (EAA) before 2025-01-17. If an admin knows another tenant's 128-bit connectoEPSS 0.4%CVE-2023-52715HIGHThe SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.4%CVE-2024-30413HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.4%CVE-2023-52388HIGHPermission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.4%CVE-2017-12713—An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. MultipEPSS 0.4%CVE-2020-10699HIGHA flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enEPSS 0.3%CVE-2025-55524HIGHInsecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.EPSS 0.3%CVE-2024-46881HIGHDevelocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduEPSS 0.3%CVE-2024-41970MEDIUMWAGO: Unauthorized Diagnostic Data Exposure in Multiple DevicesEPSS 0.3%CVE-2024-27108MEDIUMNon privileged access to critical file vulnerability in GE HealthCare EchoPAC productsEPSS 0.3%CVE-2024-28589MEDIUMAn issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbiEPSS 0.3%CVE-2020-10762—An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This EPSS 0.3%CVE-2026-9508CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStarEPSS 0.3%CVE-2019-3866MEDIUMAn information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were mEPSS 0.3%CVE-2019-18577MEDIUMDell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xEPSS 0.3%CVE-2024-37369HIGHRockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File PermissionsEPSS 0.3%CVE-2023-49582MEDIUMApache Portable Runtime (APR): Unexpected lax shared memory permissionsEPSS 0.3%CVE-2025-34135MEDIUMNagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit FilesEPSS 0.3%CVE-2024-47104MEDIUMIBM i incorrect privilege assignmentEPSS 0.3%