Weaknesses of type CWE-552

365 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2024-51542HIGHConfiguration DownloadEPSS 0.3%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%CVE-2019-3622HIGHDLP Endpoint log file redirection to arbitrary locationsEPSS 0.3%CVE-2022-1117—A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time reEPSS 0.3%CVE-2026-19093MEDIUMTutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video PathEPSS 0.3%CVE-2024-45627MEDIUMApache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerabilityEPSS 0.3%CVE-2025-43758MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2026-67402CRITICALAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual hoEPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2025-14442MEDIUMSecure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export FileEPSS 0.3%CVE-2026-77884HIGHGallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposureEPSS 0.3%CVE-2025-14697MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file accessEPSS 0.3%CVE-2026-8704MEDIUMCrypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modifiedEPSS 0.3%CVE-2022-23508HIGHGitOps Run allows for Kubernetes workload injectionEPSS 0.3%CVE-2025-69428HIGHAn issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.EPSS 0.3%CVE-2025-37130MEDIUMUnrestricted Binary allows File Enumeration in Underlying Operating SystemEPSS 0.3%CVE-2024-9945MEDIUMLimited Information Disclosure in GoAnywhere MFT Prior to 7.7.0EPSS 0.3%CVE-2026-80494HIGHYogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File DownloadEPSS 0.3%CVE-2022-40126HIGHA misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arEPSS 0.3%CVE-2026-19903MEDIUMSourceCodester Online Clothing Store SQL Database Backup shopping.sql file accessEPSS 0.3%