Falhas do tipo CWE-732

785 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2023-31748HIGHInsecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.EPSS 0.8%CVE-2017-8449—X-Pack Security 5.2.x would allow access to more fields than the user should have seen if the field level security rules used a mix of grantEPSS 0.8%CVE-2023-32992HIGHMissing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send EPSS 0.8%CVE-2021-22284HIGHSECURITY - OPC Server for AC 800M - Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-39338MEDIUMEnables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the senEPSS 0.8%CVE-2021-37306HIGHAn Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaEPSS 0.8%CVE-2025-30687MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.EPSS 0.8%CVE-2025-30682MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.EPSS 0.8%CVE-2025-30688MEDIUMVulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.EPSS 0.8%CVE-2021-4199HIGHIncorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)EPSS 0.8%CVE-2021-23055—On version 2.x before 2.0.3 and 1.x before 1.12.3, the command line restriction that controls snippet use with NGINX Ingress Controller doesEPSS 0.8%CVE-2022-0532—An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified forEPSS 0.8%CVE-2021-22716HIGHA CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unpriviEPSS 0.8%CVE-2021-3557—A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argEPSS 0.8%CVE-2021-20996MEDIUMWAGO: Managed Switches: Unsecure Cookie settingsEPSS 0.8%CVE-2026-53486CRITICALdecompress: Archive extraction can create files and links outside the target directoryEPSS 0.7%CVE-2020-1701—A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker withEPSS 0.7%CVE-2023-46142HIGHPHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext ControlEPSS 0.7%CVE-2025-43243CRITICALA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenturEPSS 0.7%CVE-2022-44715HIGHImproper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payloadEPSS 0.7%