Falhas do tipo CWE-732

856 resultados

Permissões Inadequadas em Recurso Crítico de Segurança

A aplicação ou sistema configura permissões de arquivo, diretório ou recurso de forma muito permissiva, permitindo que usuários ou processos não autorizados leiam ou modifiquem dados sensíveis. Isso viola o princípio do menor privilégio e expõe informações confidenciais ou permite alterações não intencionadas em arquivos críticos.

Exemplo

Um serviço web armazena chaves privadas de criptografia em um arquivo com permissões 644 (legível por qualquer usuário do sistema), permitindo que outro processo comprometido ou usuário local roube as credenciais. Ou um arquivo de configuração com senhas é gravado com permissões 777, permitindo modificação por qualquer usuário.

Como mitigar

Implemente permissões restritivas desde o início (ex: 600 para chaves privadas, 640 para configs sensíveis). Realize auditorias regulares de permissões em recursos críticos e use listas de controle de acesso (ACLs) para ser explícito sobre quem pode ler ou modificar cada recurso. Automatize verificações de permissões na pipeline CI/CD.

CVE-2023-32990MEDIUMA missing permission check in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers with Overall/Read permission toEPSS 0.6%CVE-2024-45497HIGHOpenshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentialsEPSS 0.6%CVE-2023-34437HIGHBaker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical ResourceEPSS 0.6%CVE-2025-0066CRITICALInformation Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)EPSS 0.6%CVE-2026-4757HIGHA VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flEPSS 0.6%CVE-2024-57547HIGHInsecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the FEPSS 0.6%CVE-2023-27095MEDIUMInsecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UsEPSS 0.6%CVE-2024-7986MEDIUMRockwell Automation ThinManager® ThinServer™ Information DisclosureEPSS 0.6%CVE-2022-42949HIGHSilverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions.EPSS 0.6%CVE-2025-26469CRITICALAn incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3EPSS 0.6%CVE-2025-45150CRITICALInsecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplyingEPSS 0.6%CVE-2022-1655—An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are createdEPSS 0.6%CVE-2023-24626MEDIUMsocket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows locaEPSS 0.5%CVE-2026-29188CRITICALFile Browser: TUS Delete Endpoint Bypasses Delete Permission CheckEPSS 0.5%CVE-2026-29516MEDIUMBuffalo TeraStation TS5400R Excessive File Permissions Information DisclosureEPSS 0.5%CVE-2025-58372HIGHRoo Code: Potential Remote Code Execution via .code-workspaceEPSS 0.5%CVE-2022-22521HIGHPrivilege Escalation in Miele Benchmark Programming ToolEPSS 0.5%CVE-2025-43247MEDIUMA permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS VenturEPSS 0.5%CVE-2023-22326MEDIUMiControl REST and tmsh vulnerabilityEPSS 0.5%CVE-2024-29964MEDIUMBrocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker filesEPSS 0.5%