Fallos del tipo CWE-22

5863 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2017-16195—pytservce is a static file server. pytservce is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16220—wind-mvc is an mvc framework. wind-mvc is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing EPSS 2.0%CVE-2017-16214—peiserver is a static file server. peiserver is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16165—calmquist.static-server is a static file server. calmquist.static-server is vulnerable to a directory traversal issue, giving an attacker acEPSS 2.0%CVE-2017-16104—citypredict.whauwiller is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the urlEPSS 2.0%CVE-2017-16182—serverxxx is a static file server. serverxxx is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plEPSS 2.0%CVE-2017-16133—goserv is an http server. goserv is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" EPSS 2.0%CVE-2017-16212—ltt is a static file server. ltt is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" EPSS 2.0%CVE-2022-41158HIGHeyoom builder Remote Code Execution VulnerabilityEPSS 2.0%CVE-2021-23043—On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an uEPSS 2.0%CVE-2017-12074—Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticEPSS 2.0%CVE-2022-0320—Essential Addons for Elementor < 5.0.5 - Unauthenticated LFIEPSS 2.0%CVE-2020-8214—A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.EPSS 2.0%CVE-2020-3241MEDIUMCisco UCS Director Path Traversal VulnerabilityEPSS 2.0%CVE-2021-43836HIGHPHP file inclusion in the Sulu admin panelEPSS 2.0%CVE-2019-18253—An attacker could use specially crafted paths in a specific request to read or delete files from Relion 670 Series (versions 1p1r26, 1.2.3.1EPSS 2.0%CVE-2022-31473MEDIUMBIG-IP APM Appliance mode vulnerability CVE-2022-31473EPSS 2.0%CVE-2023-50785LOWZoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.EPSS 2.0%CVE-2017-15894—Directory traversal vulnerability in the SYNO.FileStation.Extract in Synology DiskStation Manager (DSM) 6.0.x before 6.0.3-8754-3 and beforeEPSS 2.0%CVE-2021-32840HIGHPath Traversal in SharpZipLibEPSS 2.0%