Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2023-23330HIGHamano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.EPSS 0.8%CVE-2025-53536HIGHRoo Code allows Potential Remote Code Execution via .vscode/settings.jsonEPSS 0.8%CVE-2022-48161HIGHEasy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerabilEPSS 0.8%CVE-2022-45227HIGHThe web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backEPSS 0.8%CVE-2024-52292HIGHCraft Allows Attackers to Read Arbitrary System FilesEPSS 0.7%CVE-2023-39545—CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleEPSS 0.7%CVE-2024-27182MEDIUMApache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerabilityEPSS 0.7%CVE-2024-36442HIGHcgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the devicEPSS 0.7%CVE-2026-2330CRITICALCVE-2026-2330EPSS 0.7%CVE-2023-41916MEDIUMApache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file readingEPSS 0.7%CVE-2023-48710CRITICALiTop limit pages/exec.php script to PHP filesEPSS 0.7%CVE-2025-2651MEDIUMSourceCodester Online Eyewear Shop admin exposure of information through directory listingEPSS 0.7%CVE-2025-2652MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System exposure of information through directory listingEPSS 0.7%CVE-2019-3811MEDIUMA vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead oEPSS 0.7%CVE-2024-24161HIGHMRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.EPSS 0.7%CVE-2026-63490HIGHHandlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassEPSS 0.7%CVE-2025-25759HIGHAn issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion viaEPSS 0.7%CVE-2022-48094MEDIUMlmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.EPSS 0.7%CVE-2023-23365HIGHMusic StationEPSS 0.7%CVE-2023-23366HIGHMusic StationEPSS 0.7%