Fallos del tipo CWE-22

5807 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2014-0750—GE Proficy HMI/SCADA Path TraversalEPSS 70.2%CVE-2021-32682CRITICALMultiple vulnerabilities leading to RCEEPSS 69.9%CVE-2023-40497CRITICALLG Simple Editor saveXml Directory Traversal Remote Code Execution VulnerabilityEPSS 69.4%CVE-2022-44635HIGHApache Fineract allowed an authenticated user to perform remote code execution due to path traversalEPSS 68.8%CVE-2023-40028MEDIUMArbitrary file read via symlinks in GhostEPSS 68.7%CVE-2020-4430MEDIUMIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An aEPSS 68.5%KEVCVE-2024-23535HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2024-24994HIGHA Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitraryEPSS 68.1%CVE-2021-29492HIGHBypass of path matching rules using escaped slash charactersEPSS 66.2%CVE-2021-39316HIGHZoomSounds <= 6.45 Unauthenticated Directory Traversal and Sensitive Information DislosureEPSS 65.8%CVE-2026-34909CRITICALA malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the uEPSS 65.0%KEVCVE-2022-31474HIGHWordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory TraversalEPSS 63.8%CVE-2022-30547CRITICALA directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specialEPSS 63.7%CVE-2015-4068CRITICALDirectory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denEPSS 63.6%KEVCVE-2023-35081HIGHA path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatEPSS 63.6%KEVCVE-2024-13179HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 63.0%CVE-2023-34096MEDIUMThruk has Path Traversal Vulnerability in panorama.pmEPSS 62.7%CVE-2024-6781HIGHCalibre Arbitrary File ReadEPSS 62.4%CVE-2023-41182HIGHNETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution VulnerabilityEPSS 62.3%CVE-2020-27128MEDIUMCisco SD-WAN vManage Software Arbitrary File Creation VulnerabilityEPSS 60.8%