Falhas do tipo CWE-732

791 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2021-31894—A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions < V9.1 SP2), SIMATIC EPSS 0.2%CVE-2026-1185MEDIUMA configuration file on the local file system had improper input validation which could allow code execution and potentially lead to privileEPSS 0.2%CVE-2025-0926MEDIUMGee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files EPSS 0.2%CVE-2022-50931HIGHTeamSpeak 3.5.6 - Insecure File PermissionsEPSS 0.2%CVE-2025-54546HIGHOn affected platforms, restricted users could use SSH port forwarding to access host-internal servicesEPSS 0.2%CVE-2026-24834CRITICALKata Container to Guest micro VM privilege escalationEPSS 0.2%CVE-2014-0068—It was reported that watchman in openshift node-utils creates /var/run/watchman.pid and /var/log/watchman.ouput with world writable permissiEPSS 0.2%CVE-2025-64324HIGHKubeVirt Vulnerable to Arbitrary Host File Read and WriteEPSS 0.2%CVE-2025-41659HIGHCODESYS Control PKI Exposure Enables Remote Certificate AccessEPSS 0.2%CVE-2024-6871HIGHG DATA Total Security Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2026-10840HIGHOpenshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resourcesEPSS 0.2%CVE-2025-26169HIGHIXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration filEPSS 0.2%CVE-2023-29092LOWAn issue was discovered in Exynos Mobile Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, and Exynos 1080. Binding EPSS 0.2%CVE-2022-22148—'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTEPSS 0.2%CVE-2025-70341HIGHInsecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.EPSS 0.2%CVE-2021-37207—A vulnerability has been identified in SENTRON powermanager V3 (All versions). The affected application assigns improper access rights to a EPSS 0.2%CVE-2023-25648MEDIUMWeak Folder Permission Vulnerability in ZTE ZXCLOUD iRAIEPSS 0.2%CVE-2021-21567HIGHDell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. It may allow an authenticated user with ISI_PRIV_LOGIEPSS 0.2%CVE-2024-52328LOWECOVACS lawnmowers and vacuums insecurely store audio warning filesEPSS 0.2%CVE-2025-43266MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenturEPSS 0.2%