Falhas do tipo CWE-732

792 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2026-50544MEDIUMNortheBridge/luminalshine has Incorrect Permission Assignment for Critical Resource and Creation of Temporary File in Directory with Insecure PermissionsEPSS 0.1%CVE-2025-0164LOWIBM QRadar SIEM information disclosureEPSS 0.1%CVE-2026-50590MEDIUMIn Mimecast Incydr before 2.6.0, arbitrary file access can occur.EPSS 0.1%CVE-2025-38742MEDIUMDell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.EPSS 0.1%CVE-2026-7480HIGHAn Incorrect Permission Assignment for Critical Resource vulnerability in ASUS System Control Interface allows a local user to elevate priviEPSS 0.1%CVE-2025-53396HIGHIncorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), whiEPSS 0.1%CVE-2024-6510HIGHLocal privilege escalation vulnerability in AVG Internet SecurityEPSS 0.1%CVE-2026-14208HIGHLocal Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0EPSS 0.1%CVE-2026-20092MEDIUMCisco Intersight Virtual Appliance Privilege Escalation VulnerabilityEPSS 0.1%CVE-2025-64642HIGHMirion Medical EC2 Software NMIS BioDose Incorrect Permission Assignment for Critical ResourceEPSS 0.1%CVE-2025-54545HIGHOn affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.EPSS 0.1%CVE-2024-32010HIGHA vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extrEPSS 0.1%CVE-2026-33271MEDIUMLocal privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before builEPSS 0.1%CVE-2025-20233LOWIncorrect permissions set by the “chmod“ and “makedirs“ Python functions in Splunk App for Lookup File EditingEPSS 0.1%CVE-2025-67794HIGHAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the aEPSS 0.1%CVE-2025-68462LOWFreedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.EPSS 0.1%CVE-2025-11790MEDIUMCredentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud AgentEPSS 0.1%CVE-2025-59349LOWDirectories created via os.MkdirAll are not checked for permissionsEPSS 0.1%CVE-2026-8070HIGHIncorrect permission assignment for a critical resource in Armoury Crate allows a local user to bypass the driver’s validation mechanism, reEPSS 0.1%CVE-2019-25343HIGHNextVPN 4.10 - Insecure File PermissionsEPSS 0.1%