Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2021-42744MEDIUMPhilips MRI 1.5T and 3T Information ExposureEPSS 0.3%CVE-2023-45594MEDIUMA CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker toEPSS 0.3%CVE-2025-43749MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2025-51818MEDIUMMCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commandsEPSS 0.3%CVE-2026-73735MEDIUMAuthenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer APIEPSS 0.3%CVE-2026-34392HIGHLORIS has a path traversal in static routerEPSS 0.3%CVE-2024-29225MEDIUMELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive informatEPSS 0.3%CVE-2025-33150MEDIUMIBM Cognos Analytics Certified Containers information disclosureEPSS 0.3%CVE-2021-4112—A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elevEPSS 0.2%CVE-2026-40631HIGHBIG-IP iControl SOAP vulnerabilityEPSS 0.2%CVE-2023-2976MEDIUMUse of temporary directory for file creation in `FileBackedOutputStream` in GuavaEPSS 0.2%CVE-2023-2538MEDIUMTLS Private Key Accessible to External PartiesEPSS 0.2%CVE-2025-25799MEDIUMSeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.EPSS 0.2%CVE-2024-38876HIGHA vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All verEPSS 0.2%CVE-2025-31996MEDIUMUnprotected files are impacting HCL Unica PlatformEPSS 0.2%CVE-2021-1434MEDIUMCisco IOS XE SD-WAN Software Arbitrary File Corruption VulnerabilityEPSS 0.2%CVE-2024-23282MEDIUMThe issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14EPSS 0.2%CVE-2024-35183MEDIUMwolfictl leaks GitHub tokens to remote non-GitHub git serversEPSS 0.2%CVE-2026-35446HIGHLORIS has a path traversal in FilesDownloadHandlerEPSS 0.2%CVE-2022-42834LOWAn access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big SEPSS 0.2%