Weaknesses of type CWE-538

87 results

Exposição de informações sensíveis em arquivos acessíveis externamente

A aplicação escreve dados sensíveis (credenciais, tokens, chaves) em arquivos ou diretórios que podem ser acessados por usuários não autorizados. Isso pode ocorrer em logs, caches, arquivos temporários ou diretórios web públicos, expondo informações críticas.

Example

Uma aplicação gera um relatório em PDF com dados de clientes e o salva na pasta /var/www/html (acessível pela web), ou registra tokens de autenticação em um arquivo de log legível por qualquer usuário do sistema.

How to mitigate

Restrinja permissões de arquivo (chmod 600 ou equivalente), nunca escreva dados sensíveis em diretórios públicos, use variáveis de ambiente ou gestores de secrets para credenciais, e implemente rotação/limpeza automática de logs que contenham informações confidenciais.

CVE-2024-51977MEDIUMUnauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.EPSS 78.0%CVE-2019-6851—A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (alEPSS 29.9%CVE-2017-9947MEDIUMA vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory travEPSS 7.3%CVE-2017-16770—File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station beEPSS 1.9%CVE-2019-7618—A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into CodEPSS 1.5%CVE-2014-0772—Advantech WebAccess File and Directory Information ExposureEPSS 1.4%CVE-2014-0771—Advantech WebAccess File and Directory Information ExposureEPSS 1.4%CVE-2019-12623MEDIUMCisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration VulnerabilityEPSS 1.2%CVE-2021-32822MEDIUMFile disclosure in hbsEPSS 1.2%CVE-2025-27017MEDIUMApache NiFi: Potential Insertion of MongoDB Password in Provenance RecordEPSS 1.2%CVE-2021-1406MEDIUMCisco Unified Communications Manager Information Disclosure VulnerabilityEPSS 1.1%CVE-2024-21501MEDIUMVersions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attriEPSS 1.0%CVE-2021-21250HIGHPost-Auth External Entity Expansion (XXE)EPSS 0.9%CVE-2025-11079MEDIUMCampcodes Farm Management System file information disclosureEPSS 0.8%CVE-2025-57734MEDIUMIn JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesEPSS 0.8%CVE-2024-0191MEDIUMRRJ Nueva Ecija Engineer Online Portal file information disclosureEPSS 0.8%CVE-2023-28444CRITICALangular-server-side-configuration information disclosure vulnerability in monorepo with node.js backendEPSS 0.8%CVE-2016-20024CRITICALZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege EscalationEPSS 0.7%CVE-2023-7062HIGHAdvanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory TraversalEPSS 0.7%CVE-2023-4595HIGHInsertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmailEPSS 0.7%