Fallos del tipo CWE-22

5831 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2024-34832CRITICALDirectory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded toEPSS 5.0%CVE-2021-24453—Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoningEPSS 5.0%CVE-2018-1162—This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2EPSS 4.9%CVE-2021-24644—Images to WebP < 1.9 - Authenticated Local File InclusionEPSS 4.9%CVE-2019-13551—Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplEPSS 4.9%CVE-2020-14507—Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/dowEPSS 4.9%CVE-2025-2505CRITICALAge Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'EPSS 4.9%CVE-2017-16610—This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. AuthenticatiEPSS 4.8%CVE-2020-1631HIGHOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 4.8%KEVCVE-2021-3762—A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted containeEPSS 4.8%CVE-2018-14806—Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.EPSS 4.8%CVE-2024-12088MEDIUMRsync: --safe-links option bypass leads to path traversalEPSS 4.7%CVE-2023-29887HIGHA Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the FilEPSS 4.7%CVE-2020-6109HIGHAn exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A speciallEPSS 4.7%CVE-2018-0420MEDIUMCisco Wireless LAN Controller Software Directory Traversal VulnerabilityEPSS 4.6%CVE-2023-50916HIGHKyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local paEPSS 4.6%CVE-2024-30851MEDIUMDirectory Traversal vulnerability in codesiddhant Jasmin Ransomware v.1.0.1 allows an attacker to obtain sensitive information via the downlEPSS 4.6%CVE-2019-6754HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interactionEPSS 4.5%CVE-2020-27870HIGHThis vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1EPSS 4.5%CVE-2023-6015CRITICALMLflow Arbitrary File UploadEPSS 4.4%