Weaknesses of type CWE-117

135 results

Falta de sanitização em logs

O software escreve dados não validados diretamente nos logs sem neutralizar caracteres especiais ou sequências perigosas. Isso permite que um atacante injete conteúdo malicioso (como quebras de linha, comandos ou payloads) que será processado ou interpretado por ferramentas de análise de logs, levando a falsificação de registros, execução de código ou bypass de detecção.

Example

Um usuário envia um campo de nome contendo quebras de linha e texto malicioso. O aplicativo escreve diretamente no log: 'Usuário: Alice\nADMIN: Acesso negado revogado'. Ferramentas ou analistas lendo o log são enganadas, acreditando que o acesso foi realmente revogado.

How to mitigate

Sempre sanitize dados antes de escrever em logs: remova ou escape caracteres de controle (\n, \r, \t), use codificação apropriada (URL encoding, JSON escaping) ou substitua por espaços/asteriscos. Considere estruturado formato de logs (JSON, CEF) que lida melhor com caracteres especiais.

CVE-2024-45808MEDIUMMalicious log injection via access logs in envoyEPSS 0.4%CVE-2025-11627MEDIUMSite Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File PoisoningEPSS 0.3%CVE-2026-18148MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2023-32712HIGHUnauthenticated Log Injection in Splunk EnterpriseEPSS 0.3%CVE-2026-5078MEDIUMmorgan vulnerable to Log Forging via unneutralized control characters in :remote-userEPSS 0.3%CVE-2025-59784MEDIUMLog Pollution - Control Characters Not EscapedEPSS 0.3%CVE-2026-109786MEDIUMIn fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host aEPSS 0.3%CVE-2026-6494MEDIUMAap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized inputEPSS 0.3%CVE-2026-14350MEDIUMVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS 0.3%CVE-2025-3942MEDIUMImproper Output Neutralization for LogsEPSS 0.3%CVE-2024-0690MEDIUMAnsible-core: possible information leak in tasks that ignore ansible_no_log configurationEPSS 0.3%CVE-2026-45565HIGHRoxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)EPSS 0.3%CVE-2024-22229LOW Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker coEPSS 0.3%CVE-2025-10217MEDIUMA vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject craftEPSS 0.3%CVE-2025-66577MEDIUMcpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP TrustEPSS 0.3%CVE-2025-36625MEDIUMLog Poisoning in NessusEPSS 0.3%CVE-2026-85290MEDIUMInvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error LoggingEPSS 0.3%CVE-2025-23405MEDIUMDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For LogsEPSS 0.3%CVE-2024-35150MEDIUMIBM Maximo Application Suite log manipulationEPSS 0.3%CVE-2025-25294MEDIUMEnvoy Gateway Log Injection VulnerabilityEPSS 0.3%