Falhas do tipo CWE-732

781 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2024-9842HIGHIncorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary foldersEPSS 0.2%CVE-2024-13813HIGHInsufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary fileEPSS 0.2%CVE-2023-30897HIGHA vulnerability has been identified in SIMATIC WinCC (All versions < V7.5.2.13). Affected applications fail to set proper access rights for EPSS 0.2%CVE-2024-10256HIGHInsufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.EPSS 0.2%CVE-2019-18243—HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. ThEPSS 0.2%CVE-2019-18255—HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects.EPSS 0.2%CVE-2026-65940MEDIUMWhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.EPSS 0.2%CVE-2023-44387LOWGradle has incorrect permission assignment for symlinked files used in copy or archiving operationsEPSS 0.2%CVE-2020-36938HIGHWinAVR Version 20100110 - Insecure Folder PermissionsEPSS 0.2%CVE-2025-64322MEDIUMIncorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable CEPSS 0.2%CVE-2025-13733HIGHBuhoNTFS 1.3.2 - Local Privilege EscalationEPSS 0.2%CVE-2025-64319MEDIUMIncorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating WriteabEPSS 0.2%CVE-2024-7245HIGHPanda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2022-43517HIGHA vulnerability has been identified in Simcenter STAR-CCM+ (All versions < V2306). The affected application improperly assigns file permissiEPSS 0.2%CVE-2021-47756HIGHLaravel Valet 2.0.3 - Local Privilege Escalation (macOS)EPSS 0.2%CVE-2024-7572HIGHInsufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.EPSS 0.2%CVE-2022-22141—'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL cEPSS 0.2%CVE-2026-76371LOWIncorrect Permission Assignment through Safe Mode in FireAMP for Splunk SOAREPSS 0.2%CVE-2025-14740MEDIUMDocker Desktop for Windows Incorrect Permission Assignment Privilege Escalation VulnerabilitiesEPSS 0.2%CVE-2022-29263HIGHOn F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prEPSS 0.2%