Weaknesses of type CWE-117

135 results

Falta de sanitização em logs

O software escreve dados não validados diretamente nos logs sem neutralizar caracteres especiais ou sequências perigosas. Isso permite que um atacante injete conteúdo malicioso (como quebras de linha, comandos ou payloads) que será processado ou interpretado por ferramentas de análise de logs, levando a falsificação de registros, execução de código ou bypass de detecção.

Example

Um usuário envia um campo de nome contendo quebras de linha e texto malicioso. O aplicativo escreve diretamente no log: 'Usuário: Alice\nADMIN: Acesso negado revogado'. Ferramentas ou analistas lendo o log são enganadas, acreditando que o acesso foi realmente revogado.

How to mitigate

Sempre sanitize dados antes de escrever em logs: remova ou escape caracteres de controle (\n, \r, \t), use codificação apropriada (URL encoding, JSON escaping) ou substitua por espaços/asteriscos. Considere estruturado formato de logs (JSON, CEF) que lida melhor com caracteres especiais.

CVE-2019-14858HIGHA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramEPSS 0.4%CVE-2023-0595MEDIUMA CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious pEPSS 0.4%CVE-2025-20384MEDIUMUnauthenticated Log Injection in Splunk EnterpriseEPSS 0.4%CVE-2026-87859MEDIUMmorgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsEPSS 0.4%CVE-2020-14332MEDIUMA flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensEPSS 0.4%CVE-2023-6002MEDIUMLog InjectionEPSS 0.4%CVE-2025-41429LOWa-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated atEPSS 0.4%CVE-2026-15603MEDIUMmorgan vulnerable to Log Forging via unescaped Unicode line separatorsEPSS 0.4%CVE-2024-13949MEDIUMLog ForgingEPSS 0.4%CVE-2025-59476MEDIUMJenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified coEPSS 0.4%CVE-2023-38020MEDIUMIBM SOAR QRadar Plugin App log injectionEPSS 0.4%CVE-2026-16188MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.4%CVE-2026-119423MEDIUMOPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login UsernameEPSS 0.4%CVE-2025-57564HIGHCubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/inserEPSS 0.4%CVE-2025-58580MEDIUMInjection via log fileEPSS 0.4%CVE-2026-48083MEDIUMOpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limitsEPSS 0.4%CVE-2026-117977HIGHOther issue in the Console componentEPSS 0.4%CVE-2023-7234MEDIUMIntegration Objects OPC UA Server Toolkit Improper Output Neutralization for LogsEPSS 0.4%CVE-2023-28952MEDIUMIBM Cognos Controller log injectionEPSS 0.4%CVE-2026-41504MEDIUMOWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsEPSS 0.4%