Weaknesses of type CWE-552

365 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2017-2622MEDIUMAn accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readableEPSS 0.4%CVE-2025-58753MEDIUMcopyparty: Sharing a single file does not fully restrict access to other files in source folderEPSS 0.4%CVE-2025-37177MEDIUMAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)EPSS 0.4%CVE-2025-66625MEDIUMUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityEPSS 0.4%CVE-2026-33380MEDIUMSQL Expressions Read File From DiskEPSS 0.4%CVE-2024-5056MEDIUMCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and pEPSS 0.4%CVE-2026-37065CRITICALVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.EPSS 0.4%CVE-2026-73705HIGHAuthenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.3%CVE-2025-45529HIGHAn arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sendiEPSS 0.3%CVE-2025-14771HIGHFile Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteEPSS 0.3%CVE-2023-47612MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, TelitEPSS 0.3%CVE-2026-4760HIGHPotential unauthorized access to files on the Web HMI server hostEPSS 0.3%CVE-2023-4588MEDIUMFile accessibility vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2026-8715CRITICALVault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPathEPSS 0.3%CVE-2025-52460MEDIUMFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exEPSS 0.3%CVE-2023-52112MEDIUMUnauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to EPSS 0.3%CVE-2024-45894MEDIUMBlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.EPSS 0.3%CVE-2024-41699MEDIUMPriority – CWE-552: Files or Directories Accessible to External PartiesEPSS 0.3%CVE-2024-50627HIGHAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It alEPSS 0.3%CVE-2026-82020HIGHHermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write ToolEPSS 0.3%