Weaknesses of type CWE-428

355 results

Caminho de busca ou elemento sem aspas

Ocorre quando o código procura executar um programa ou carregar uma biblioteca sem envolver o caminho em aspas, permitindo que espaços ou caracteres especiais no caminho sejam interpretados como separadores. Um atacante pode criar um executável em um diretório intermediário (ex: C:\Program Files\) e fazer com que o programa execute seu arquivo malicioso em vez do legítimo.

Example

Uma aplicação tenta chamar C:\Program Files\MyApp\tool.exe sem aspas. Se o Windows procura em C:\Program.exe primeiro (por causa do espaço), um atacante pode colocar um programa malicioso em C:\ com esse nome e ganhar execução de código.

How to mitigate

Sempre envolva caminhos completos em aspas duplas ("C:\\Program Files\\MyApp\\tool.exe") ou use APIs que aceitam argumentos separados (sem passar por shell parsing). Valide e normalize caminhos antes de usá-los.

CVE-2021-47767HIGH10-Strike Network Inventory Explorer Pro 9.31 - 'srvInventoryWebServer' Unquoted Service PathEPSS 0.2%CVE-2021-47805HIGHDisk Savvy 13.6.14 - 'Multiple' Unquoted Service PathEPSS 0.2%CVE-2021-47806HIGHDup Scout 13.5.28 - 'Multiple' Unquoted Service PathEPSS 0.2%CVE-2024-25552HIGHWiesemann & Theis: Multiple products prone to unquoted search pathEPSS 0.2%CVE-2023-3438MEDIUM An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). TEPSS 0.2%CVE-2023-53965HIGHSOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service PathEPSS 0.2%CVE-2022-50900HIGHWondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service PathEPSS 0.2%CVE-2021-47810HIGHWibuKey Runtime 6.51 - 'WkSvW32.exe' Unquoted Service PathEPSS 0.2%CVE-2021-47790HIGHActive WebCam 11.5 - Unquoted Service PathEPSS 0.2%CVE-2025-54081MEDIUMSunshineService Has Unquoted Service Path That Allows Local SYSTEM Code ExecutionEPSS 0.2%CVE-2021-47807HIGHSync Breeze 13.6.18 - 'Multiple' Unquoted Service PathEPSS 0.2%CVE-2019-25267HIGHWing FTP Server 6.0.7 - Unquoted Service PathEPSS 0.2%CVE-2021-47809HIGHDisk Sorter Enterprise 13.6.12 - 'Disk Sorter Enterprise' Unquoted Service PathEPSS 0.2%CVE-2021-47792HIGHRemote Mouse 4.002 - Unquoted Service PathEPSS 0.2%CVE-2024-4031MEDIUMMEVO WEBCAM APP Windows Unquoted Service Path VulnerabilityEPSS 0.2%CVE-2022-0883HIGHWindows Unquoted/Trusted Service PathsEPSS 0.2%CVE-2019-25308HIGHMikogo 5.2.2.150317 - 'Mikogo-Service' Unquoted Service PathEPSS 0.2%CVE-2023-42486MEDIUMFortect - CWE-428: Unquoted Search Path or ElementEPSS 0.2%CVE-2022-50923HIGHCobian Backup 0.9 - Unquoted Service PathEPSS 0.2%CVE-2022-50971HIGHMalwarebytes 4.5 Unquoted Service Path Privilege EscalationEPSS 0.2%