Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2025-66625MEDIUMUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityEPSS 0.4%CVE-2024-5056MEDIUMCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and pEPSS 0.4%CVE-2025-14771HIGHFile Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteEPSS 0.3%CVE-2023-47612MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, TelitEPSS 0.3%CVE-2023-4588MEDIUMFile accessibility vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2025-37130MEDIUMUnrestricted Binary allows File Enumeration in Underlying Operating SystemEPSS 0.3%CVE-2024-45894MEDIUMBlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.EPSS 0.3%CVE-2025-52460MEDIUMFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exEPSS 0.3%CVE-2023-52112MEDIUMUnauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to EPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2022-23508HIGHGitOps Run allows for Kubernetes workload injectionEPSS 0.3%CVE-2024-41699MEDIUMPriority – CWE-552: Files or Directories Accessible to External PartiesEPSS 0.3%CVE-2024-50627HIGHAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It alEPSS 0.3%CVE-2022-1117—A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time reEPSS 0.3%CVE-2023-41566HIGHOA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerabilEPSS 0.3%CVE-2024-51542HIGHConfiguration DownloadEPSS 0.3%CVE-2024-45627MEDIUMApache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerabilityEPSS 0.3%CVE-2026-4760HIGHPotential unauthorized access to files on the Web HMI server hostEPSS 0.3%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%CVE-2026-85175HIGHSiYuan before v3.8.2 TLS Private Key Disclosure via getFileEPSS 0.3%