Fallos del tipo CWE-22

6626 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2023-6893MEDIUMHikvision Intercom Broadcasting System exportrecord.php path traversalEPSS 70.2%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2014-0750—GE Proficy HMI/SCADA Path TraversalEPSS 69.8%CVE-2026-34909CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uEPSS 69.2%KEVCVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2020-4430MEDIUMIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An aEPSS 68.5%KEVCVE-2024-23535HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2024-24994HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2023-40497CRITICALLG Simple Editor saveXml Directory Traversal Remote Code Execution VulnerabilityEPSS 67.3%CVE-2021-39316HIGHZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureEPSS 65.8%CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 65.7%CVE-2022-30547CRITICALA directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specialEPSS 64.5%CVE-2024-57728HIGHSimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading aEPSS 64.5%KEVCVE-2024-13179HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 63.8%CVE-2022-31474HIGHWordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory TraversalEPSS 63.8%CVE-2015-4068CRITICALDirectory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denEPSS 63.6%KEVCVE-2023-35081HIGHA path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatEPSS 63.6%KEVCVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 63.1%CVE-2023-34096MEDIUMThruk has Path Traversal Vulnerability in panorama.pmEPSS 62.7%CVE-2024-6781HIGHCalibre Arbitrary File ReadEPSS 62.4%