Weaknesses of type CWE-548

57 results

Exposição de Informações por Listagem de Diretórios

Ocorre quando o servidor web lista o conteúdo de um diretório em vez de servir um arquivo padrão (como index.html), expondo nomes de arquivos, estrutura do projeto e potencialmente dados sensíveis. Atacantes usam isso para descobrir endpoints, backups, arquivos de configuração esquecidos ou vulnerabilidades no aplicativo.

Example

Um desenvolvedor acessa /uploads/ no navegador e, em vez de um erro 403, recebe uma listagem HTML mostrando todos os arquivos enviados por usuários, incluindo backups de banco de dados (.sql), arquivos de configuração (.env) ou chaves privadas esquecidas.

How to mitigate

Desabilite directory listing no servidor (DirectoryIndex desativado ou Options -Indexes no Apache; autoindex off no Nginx) e sempre forneça um arquivo padrão (index.html ou index.php) em diretórios acessíveis. Configure permissões restritivas e revise logs para detectar explorações passadas.

CVE-2024-2340MEDIUMAvada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory ListingEPSS 28.0%CVE-2020-8161—A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::DiEPSS 3.4%CVE-2018-14785—NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the device is listed openly EPSS 2.2%CVE-2018-16493—A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the servEPSS 1.8%CVE-2019-5415—A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the vEPSS 1.7%CVE-2018-10590—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 1.7%CVE-2017-6045—An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server apEPSS 1.7%CVE-2020-15081MEDIUMInformation exposure in the upload directory in PrestaShopEPSS 1.6%CVE-2019-5437—Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to EPSS 1.3%CVE-2020-7858MEDIUMAquaNPlayer directory traversing vulnerabilityEPSS 1.1%CVE-2025-4807MEDIUMSourceCodester Online Student Clearance System exposure of information through directory listingEPSS 1.1%CVE-2021-27505HIGHmySCADA myPRO Exposure of Information Through Directory ListingEPSS 1.0%CVE-2021-21528HIGHDell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This EPSS 1.0%CVE-2020-15790—A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server mighEPSS 0.9%CVE-2021-32510MEDIUMQSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus functionEPSS 0.9%CVE-2021-32511MEDIUMQSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList functionEPSS 0.9%CVE-2021-23195MEDIUMFresenius Kabi Agilia Connect Infusion System exposure of information through directory listingEPSS 0.8%CVE-2024-8711MEDIUMSourceCodester Food Ordering Management System includes exposure of information through directory listingEPSS 0.8%CVE-2024-7912MEDIUMCodeAstro Online Railway Reservation System assets exposure of information through directory listingEPSS 0.8%CVE-2021-32515MEDIUMQSAN Storage Manager - Exposure of Information Through Directory ListingEPSS 0.8%