Falhas do tipo CWE-275

49 resultados

Problemas de Permissões

Fraqueza genérica que abrange falhas na configuração, verificação ou aplicação de permissões de acesso a recursos (arquivos, diretórios, APIs, dados). O software não valida adequadamente se o usuário tem direito de executar uma ação, permitindo acesso não autorizado a informações sensíveis ou operações críticas.

Exemplo

Um aplicativo web que lista arquivos de um usuário consultando diretamente o ID do arquivo na URL (ex: /arquivos/123) sem verificar se o usuário logado é o proprietário, permitindo que qualquer outro usuário autenticado acesse arquivos alheios.

Como mitigar

Implemente verificações explícitas de permissão antes de qualquer acesso a recursos (validar propriedade, grupo, role). Use modelos de controle de acesso bem definidos (RBAC, ABAC) e teste-os sistematicamente, incluindo testes de escalação de privilégio e acesso lateral.

CVE-2025-6765MEDIUMIntelbras InControl HTTP PUT Request operador permissionEPSS 0.4%CVE-2014-1422MEDIUMLocation service uses cached authorization even after revocationEPSS 0.4%CVE-2022-25153HIGHITarian - Local privilege escalation in Endpoint Manager agent on WindowsEPSS 0.3%CVE-2021-22566MEDIUMIncorrect mapping of Executable bits in Fuchsia KernelEPSS 0.3%CVE-2023-39399CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.3%CVE-2023-39398CRITICALParameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaEPSS 0.3%CVE-2024-11485MEDIUMCode4Berry Decoration Management System User userregister.php permissionEPSS 0.3%CVE-2020-6022—Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.EPSS 0.3%CVE-2024-11486MEDIUMCode4Berry Decoration Management System User Permission user_permission.phpEPSS 0.3%CVE-2020-8474HIGHABB System 800xA Weak Registry PermissionsEPSS 0.3%CVE-2023-37238—Vulnerability of apps' permission to access a certain API being incompletely verified in the wireless projection module. Successful exploitaEPSS 0.3%CVE-2018-0392—A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulEPSS 0.3%CVE-2018-0449MEDIUMCisco Jabber Client Framework Insecure Directory Permissions VulnerabilityEPSS 0.3%CVE-2019-12622MEDIUMCisco RoomOS Software Privilege Escalation VulnerabilityEPSS 0.3%CVE-2019-15962MEDIUMCisco TelePresence Collaboration Endpoint Software Arbitrary File Write VulnerabilityEPSS 0.3%CVE-2021-22571MEDIUMInformation Leak in SA360-webquery-bigquery through read on /tmpEPSS 0.2%CVE-2022-22251HIGHcSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privilegesEPSS 0.2%CVE-2025-54624MEDIUMUnexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.2%CVE-2025-53168MEDIUMVulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this EPSS 0.1%CVE-2026-28553MEDIUMVulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect sEPSS 0.1%