Fallos del tipo CWE-379

59 resultados

Criação de arquivo temporário em diretório com permissões inseguras

A aplicação cria arquivos temporários em diretórios (como /tmp no Linux) onde outros usuários do sistema podem ler, modificar ou substituir esses arquivos. Um atacante local pode interceptar dados sensíveis, injetar conteúdo malicioso ou executar código aproveitando a confiança que a aplicação deposita no arquivo temporário.

Ejemplo

Um programa escreve um token de sessão ou chave privada em /tmp/app_temp_12345 sem restringir permissões. Outro usuário do sistema lê esse arquivo antes da aplicação deletá-lo, ou substitui o arquivo com conteúdo manipulado que a aplicação carrega.

Cómo mitigar

Use funções seguras para criar temporários (mkstemp no POSIX, tempfile.NamedTemporaryFile no Python) que geram nomes aleatórios e definem permissões restritas (0600) automaticamente. Alternativamente, use diretórios privados da aplicação (/var/run/app ou similar) ao invés de /tmp, e sempre valide o conteúdo lido de arquivos temporários.

CVE-2020-11979—As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was alEPSS 8.2%CVE-2020-27216—In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sysEPSS 4.4%CVE-2023-26396HIGHAdobe Acrobat Reader DC for macOS installer (AcroRdrDC_2200220191_MUI.pkg) contains a local privilege escalation vulnerability.EPSS 4.0%CVE-2024-36821HIGHInsecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.EPSS 2.9%CVE-2021-21290MEDIUMLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesEPSS 1.8%CVE-2021-21100HIGHAdobe Digital Editions Arbitrary file system write vulnerabilityEPSS 1.7%CVE-2021-40708HIGHAdobe Genuine Service Installer Privilege Escalation VulnerabilityEPSS 1.7%CVE-2021-39827MEDIUMAdobe Digital Editions Installer flaw leads to Arbitrary File System WriteEPSS 1.5%CVE-2021-39828MEDIUMAdobe Digital Editions Installer flaw leads to Local Privilege EscalationEPSS 1.5%CVE-2022-23950HIGHIn Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prEPSS 1.3%CVE-2016-9486—On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because files are created in a folder with incorrect privilegesEPSS 1.2%CVE-2025-21173HIGH.NET Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-43017MEDIUMAdobe Creative Cloud DLL Hijacking Local Application Denial of ServiceEPSS 1.1%CVE-2022-24823MEDIUMLocal Information Disclosure Vulnerability in io.netty:netty-codec-httpEPSS 1.0%CVE-2021-28168MEDIUMEclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use EPSS 0.9%CVE-2020-8831MEDIUMWorld writable root owned lock file created in user controllable locationEPSS 0.7%CVE-2021-21068MEDIUMAdobe Creative Cloud installer arbitrary file overwrite vulnerabilityEPSS 0.6%CVE-2021-28568MEDIUMAdobe Genuine Services insecure file permission could lead to privilege escalationEPSS 0.6%CVE-2021-21331LOWDataDog API Client contains a Local Information Disclosure VulnerabilityEPSS 0.6%CVE-2021-29428HIGHLocal privilege escalation through system temporary directoryEPSS 0.5%