Weaknesses of type CWE-552

398 results

Arquivos ou diretórios acessíveis a terceiros

Ocorre quando arquivos ou diretórios sensíveis ficam expostos com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo confidencial. É um erro de configuração de controle de acesso que compromete a confidencialidade e integridade dos dados.

Example

Um servidor web que salva chaves privadas de API ou credenciais de banco de dados em um diretório público (/var/www/html), ou um arquivo de configuração com modo 644 contendo senhas que qualquer usuário do sistema consegue ler. Um atacante consegue recuperar essas informações sensíveis sem autenticação.

How to mitigate

Aplique o princípio do menor privilégio: defina permissões de arquivo (chmod) e ACLs restritivas (apenas quem precisa acessa), armazene dados sensíveis fora da raiz pública do servidor web, use variáveis de ambiente ou cofres de secrets para credenciais, e audite regularmente permissões e propriedade de arquivos críticos.

CVE-2026-40564MEDIUMApache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes OperatorEPSS 0.7%CVE-2023-26956HIGHonekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.EPSS 0.7%CVE-2026-33071MEDIUMFileRise: WebDAV upload path bypasses filename validation enforced by regular uploadsEPSS 0.7%CVE-2021-22769MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that coulEPSS 0.7%CVE-2023-29107MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versiEPSS 0.6%CVE-2026-63042HIGHApache InLong: Missing authorization on DataNode management endpointsEPSS 0.6%CVE-2026-63040HIGHApache InLong: Missing authorization in StreamSource forceDeleteEPSS 0.6%CVE-2022-44343HIGHCRMEB 4.4.4 is vulnerable to Any File download.EPSS 0.6%CVE-2021-3996MEDIUMA logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.EPSS 0.6%CVE-2021-3995—A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.EPSS 0.6%CVE-2021-31831MEDIUMIncorrect access to deleted scripts vulnerability in McAfee DBSecEPSS 0.6%CVE-2020-15224MEDIUMSocket syscalls can leak enclave memory contents in Open EnclaveEPSS 0.6%CVE-2024-5262CRITICALProjectDiscovery Interactsh - Files or Directories Accessible to External PartiesEPSS 0.6%CVE-2025-2038MEDIUMcode-projects Blood Bank Management System upload exposure of information through directory listingEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2024-53649HIGHA vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9EPSS 0.6%CVE-2022-45426MEDIUMSome Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by seEPSS 0.6%CVE-2020-37082HIGHwebERP 4.15.1 - Unauthenticated Backup File AccessEPSS 0.6%CVE-2023-4743LOWDreamer CMS file accessEPSS 0.6%CVE-2024-7729HIGHCAYIN Technology CMS - Sensitive File DownloadEPSS 0.6%