Falhas do tipo CWE-732

792 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2026-76159HIGHDuplicati for Windows - Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2022-50690HIGHWondershare MirrorGo 2.0.11.346 Local Privilege Escalation via Insecure File PermissionsEPSS 0.1%CVE-2025-43729HIGHDell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A local lowEPSS 0.1%CVE-2026-35367LOWuutils coreutils nohup Information Disclosure via Insecure Default Output PermissionsEPSS 0.1%CVE-2025-8108MEDIUMAn ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This vEPSS 0.1%CVE-2025-43290MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26EPSS 0.1%CVE-2025-11906MEDIUMPrivilege escalation via writable configuration files in Progress FlowmonEPSS 0.1%CVE-2025-57741HIGHAn Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11EPSS 0.1%CVE-2024-47475MEDIUMDell PowerScale OneFS 8.2.2.x through 9.8.0.x contains an incorrect permission assignment for critical resource vulnerability. A locally autEPSS 0.1%CVE-2026-28264LOWDell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerabilityEPSS 0.1%CVE-2026-3113MEDIUMmmctl export download command doesn’t restrict permissions to created file to file ownerEPSS 0.1%CVE-2026-22768HIGHDell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attackerEPSS 0.1%CVE-2025-4952MEDIUMDenial-of-service vulnerability in ESET security products for WindowsEPSS 0.1%CVE-2026-66785LOWSubmariner: ipsec psk secrets file created with default world-readable permissionsEPSS 0.1%CVE-2025-2503MEDIUMAn improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file EPSS 0.1%CVE-2025-9578HIGHLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (WindoEPSS 0.1%CVE-2026-41686MEDIUMClaude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory ToolEPSS 0.1%CVE-2026-32684LOWThe application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications EPSS 0.1%CVE-2024-45655MEDIUMIBM Application Gateway incorrect permission assignmentEPSS 0.1%CVE-2026-50544MEDIUMNortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure PermissionsEPSS 0.1%