Falhas do tipo CWE-732

873 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2020-7314HIGHPrivilege Escalation vulnerability in McAfee DXL for MacEPSS 0.4%CVE-2024-21902MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2026-65940MEDIUMWhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.EPSS 0.4%CVE-2023-52715HIGHThe SystemUI module has a vulnerability in permission management. Impact: Successful exploitation of this vulnerability may affect availabilEPSS 0.4%CVE-2026-76388HIGHPrivilege Escalation through Search Macro Permissions in Splunk Enterprise SecurityEPSS 0.4%CVE-2017-12713—An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. MultipEPSS 0.4%CVE-2023-52388HIGHPermission control vulnerability in the clock module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.4%CVE-2026-24049HIGHwheel Allows Arbitrary File Permission Modification via Path TraversalEPSS 0.4%CVE-2026-76399HIGHIncorrect Permission Assignment for Scheduled Searches in Splunk AI ToolkitEPSS 0.4%CVE-2024-30413HIGHVulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affEPSS 0.4%CVE-2025-34323HIGHNagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo RulesEPSS 0.3%CVE-2026-77256HIGHMCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umaskEPSS 0.3%CVE-2025-55524HIGHInsecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.EPSS 0.3%CVE-2024-27108MEDIUMNon privileged access to critical file vulnerability in GE HealthCare EchoPAC productsEPSS 0.3%CVE-2024-28589MEDIUMAn issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbiEPSS 0.3%CVE-2026-107045CRITICALInsecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarilyEPSS 0.3%CVE-2026-9508CRITICALIncorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStarEPSS 0.3%CVE-2020-10762—An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This EPSS 0.3%CVE-2026-76260MEDIUMIncorrect Permission Assignment for Critical Resource through the REST API in Splunk EnterpriseEPSS 0.3%CVE-2019-3866MEDIUMAn information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were mEPSS 0.3%