Falhas do tipo CWE-732

791 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2020-1706HIGHIt has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers EPSS 0.2%CVE-2026-8110HIGHIncorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to esEPSS 0.2%CVE-2024-38456HIGHHIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulEPSS 0.2%CVE-2025-70342MEDIUMerase-install prior to v40.4 commit 2c31239 writes swiftDialog credential output to a hardcoded path /var/tmp/dialog.json. This allows an unEPSS 0.2%CVE-2026-63522HIGHAzure SQL Database Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-7612HIGHInsecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components.EPSS 0.2%CVE-2026-10997MEDIUMInsufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a EPSS 0.2%CVE-2023-34042MEDIUMThe spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be wriEPSS 0.2%CVE-2023-28134HIGHLocal Privliege Escalation in Check Point Endpoint Security Remediation ServiceEPSS 0.2%CVE-2024-41720HIGHIncorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allowEPSS 0.2%CVE-2026-48499CRITICALActivepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheEPSS 0.2%CVE-2021-47742HIGHEpic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure PermissionsEPSS 0.2%CVE-2019-25245HIGHRoss Video DashBoard 8.5.1 Privilege Escalation via Insecure PermissionsEPSS 0.2%CVE-2024-27294HIGHdp-golang Go installation could be owned by wrong userEPSS 0.2%CVE-2025-64298HIGHMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2023-51579HIGHVoltronic Power ViewPower Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-41664HIGHImproper Permission Handling Enables Unauthorized Access to Firmware and CertificatesEPSS 0.2%CVE-2021-23021—The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission biEPSS 0.2%CVE-2025-46802MEDIUMTemporary chown() of users' TTY to mode 0666 allows PTY hijacking in screenEPSS 0.2%CVE-2021-31894—A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC EPSS 0.2%