Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2019-3622HIGHDLP Endpoint log file redirection to arbitrary locationsEPSS 0.3%CVE-2025-43758MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2025-14442MEDIUMSecure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export FileEPSS 0.3%CVE-2025-14697MEDIUMShenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file accessEPSS 0.3%CVE-2022-40126HIGHA misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arEPSS 0.3%CVE-2025-69428HIGHAn issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.EPSS 0.3%CVE-2026-8704MEDIUMCrypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modifiedEPSS 0.3%CVE-2025-66955MEDIUMLocal File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access fileEPSS 0.3%CVE-2024-9945MEDIUMLimited Information Disclosure in GoAnywhere MFT Prior to 7.7.0EPSS 0.3%CVE-2025-58152MEDIUMFutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the inEPSS 0.3%CVE-2021-3717—A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_UEPSS 0.3%CVE-2025-12747MEDIUMTainacan <= 1.0.0 - Unauthenticated Information ExposureEPSS 0.3%CVE-2026-39871HIGHA path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5.EPSS 0.3%CVE-2026-108938MEDIUMcode-projects Matrimonial System matrimony.sql file accessEPSS 0.3%CVE-2026-45088HIGHDalfox: Unauthenticated Arbitrary File Read with Out-of-Band Exfiltration via `custom-payload-file` in Dalfox Server ModeEPSS 0.3%CVE-2018-25164HIGHEverSync 0.5 Arbitrary File Download via files DirectoryEPSS 0.3%CVE-2020-25636MEDIUMA flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are EPSS 0.3%CVE-2026-24732MEDIUMImproper permission checks in Extension:NSFileRepoEPSS 0.3%CVE-2025-2222HIGHCWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential priviEPSS 0.3%CVE-2026-102695HIGHOmniFaces: Forged combined-resource IDs and related output/push boundariesEPSS 0.3%