Fallos del tipo CWE-22

6626 resultados

Travessia de diretório (path traversal)

A aplicação constrói caminhos de arquivo a partir de entrada do usuário sem validar adequadamente sequências como '../' ou símbolos absolutos, permitindo que um atacante acesse arquivos fora do diretório permitido. Isso expõe dados sensíveis ou permite execução não autorizada de operações no sistema de arquivos.

Ejemplo

Um sistema web que serve documentos de um diretório específico recebe a requisição 'GET /doc?file=../../etc/passwd'. Se não validar a entrada, o código resolve o caminho para fora do diretório restrito e vaza o arquivo de senhas do sistema.

Cómo mitigar

Valide caminhos usando listas brancas de nomes de arquivo permitidos, normalize caminhos (remover '../' e símbolos), use APIs que isolem automaticamente operações em diretório base (ex: chroot, sandbox), e evite concatenar entrada direta em construtores de caminhos. Teste com payloads comuns de path traversal em testes de segurança.

CVE-2014-0130HIGHDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails beforEPSS 53.7%KEVCVE-2022-35650—The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks rEPSS 53.7%CVE-2024-41163HIGHA directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can leEPSS 52.5%CVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2009-1936CRITICAL_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows reEPSS 51.9%CVE-2023-25652HIGH"git apply --reject" partially-controlled arbitrary file writeEPSS 51.9%CVE-2021-43778CRITICALPath traversal in GLPI barcode pluginEPSS 51.7%CVE-2021-20023MEDIUMSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thEPSS 51.7%KEVCVE-2017-16720—A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structurEPSS 50.3%CVE-2019-15980HIGHCisco Data Center Network Manager Path Traversal VulnerabilitiesEPSS 50.0%CVE-2024-46909CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 48.9%CVE-2023-26802CRITICALAn issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass autheEPSS 48.7%CVE-2020-5377CRITICALDell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated rEPSS 48.6%CVE-2024-12849HIGHError Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File ReadEPSS 48.0%CVE-2022-0679—Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCEEPSS 47.8%CVE-2024-25065CRITICALApache OFBiz: Path traversal allowing authentication bypass.EPSS 47.7%CVE-2018-0258—A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary fEPSS 47.6%CVE-2016-3976HIGHDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot doEPSS 47.3%KEVCVE-2023-26255HIGHAn unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By mEPSS 47.2%CVE-2023-47211CRITICALA directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP requeEPSS 47.0%