Falhas do tipo CWE-732

792 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2025-52627MEDIUMHCL AION is susceptible to Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2026-28829MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS TahoEPSS 0.2%CVE-2026-3315MEDIUMLocal Privilege Escalation Due to Writable Executable in Privileged Visionline Service PathEPSS 0.2%CVE-2026-28725MEDIUMSensitive information disclosure due to improper configuration of a headless browser. The following products are affected: Acronis Cyber ProEPSS 0.2%CVE-2026-9489HIGHNitroSense V3: Local Privilege Escalation (LPE) vulnerabilityEPSS 0.2%CVE-2026-45246MEDIUMSummarize < 0.15.1 Insecure File Permissions Information DisclosureEPSS 0.2%CVE-2023-28068HIGH Dell Command Monitor, versions 10.9 and prior, contains an improper folder permission vulnerability. A local authenticated malicious user cEPSS 0.2%CVE-2026-9651MEDIUMCWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and EPSS 0.2%CVE-2024-25956MEDIUMDell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. A locally authenticated attacker couldEPSS 0.2%CVE-2026-65348MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOSEPSS 0.2%CVE-2026-64707MEDIUMA permissions issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6,EPSS 0.2%CVE-2025-23257HIGHNVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate privEPSS 0.2%CVE-2025-23258HIGHNVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to EPSS 0.2%CVE-2026-2254MEDIUMHitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical ResourceEPSS 0.2%CVE-2024-24910HIGHLocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfileEPSS 0.2%CVE-2026-15430MEDIUMCVE-2026-15430EPSS 0.2%CVE-2020-24681HIGHAutomation Studio and PVI Multiple incorrect permission assignments for servicesEPSS 0.2%CVE-2026-18270HIGHKenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-35999MEDIUMIncorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and IntEPSS 0.2%CVE-2025-30413MEDIUMCredentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentEPSS 0.2%