Weaknesses of type CWE-277

71 results

Permissões Herdadas Inseguras

Ocorre quando um processo, arquivo, diretório ou recurso herda permissões de acesso de seu pai de forma insegura, permitindo que usuários sem privilégio adequado acessem ou modifiquem dados sensíveis. O problema é que a aplicação não valida ou restringe essas permissões após a herança, deixando brechas na cadeia de controle de acesso.

Example

Um arquivo temporário criado dentro de um diretório com permissões amplas (777) herda automaticamente essa abertura. Se a aplicação não redefine as permissões do arquivo para algo mais restritivo (por exemplo, 600), qualquer usuário do sistema consegue ler ou alterar dados sensíveis ali armazenados, como tokens ou credenciais.

How to mitigate

Sempre defina explicitamente permissões restritivas no momento da criação de arquivos, diretórios e processos, sem depender da herança do pai. Use umask apropriado, aplique ACLs explícitas e valide permissões em tempo de execução, especialmente para recursos que lidam com dados sensíveis.

CVE-2025-56019MEDIUMAn insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobile applications to coEPSS 0.3%CVE-2025-64185MEDIUMOpen OnDemand RPM packages create world writable locationsEPSS 0.3%CVE-2023-29065MEDIUMOverly Permissive Access PolicyEPSS 0.3%CVE-2026-7891CRITICALA vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe theEPSS 0.3%CVE-2020-5343HIGHDell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissEPSS 0.3%CVE-2025-36104MEDIUMIBM Storage Scale information disclosureEPSS 0.3%CVE-2024-36691MEDIUMInsecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify usersEPSS 0.3%CVE-2025-9039MEDIUMInformation Disclosure in Amazon ECS Container AgentEPSS 0.2%CVE-2025-22448MEDIUMInsecure inherited permissions for some Intel(R) Simics(R) Package Manager software before version 1.12.0 may allow an authenticated user toEPSS 0.2%CVE-2024-27847HIGHThis issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS MontereyEPSS 0.2%CVE-2024-23233HIGHThis issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to thiEPSS 0.2%CVE-2025-65111LOWSpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete ResultsEPSS 0.2%CVE-2024-27848HIGHThis issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. A maliciousEPSS 0.2%CVE-2024-29417HIGHInsecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password resEPSS 0.2%CVE-2024-27825HIGHA downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS EPSS 0.2%CVE-2018-25111MEDIUMdjango-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.EPSS 0.2%CVE-2023-34997MEDIUMInsecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authEPSS 0.2%CVE-2023-45736MEDIUMInsecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enaEPSS 0.2%CVE-2024-45599LOWTCC Bypass in Cursor's macOS ApplicationEPSS 0.2%CVE-2023-34314MEDIUMInsecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentiallEPSS 0.2%