Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2023-2356CRITICALRelative Path Traversal in mlflow/mlflowEPSS 4.2%CVE-2020-5237HIGHRelative Path Traversal in oneup/uploader-bundleEPSS 3.9%CVE-2020-12006—Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a loEPSS 3.7%CVE-2019-3943—MikroTik RouterOS versions Stable 6.43.12 and below, Long-term 6.42.12 and below, and Testing 6.44beta75 and below are vulnerable to an authEPSS 3.7%CVE-2020-8570—Kubernetes Java client libraries unvalidated path traversal in Copy implementationEPSS 3.6%CVE-2023-42791HIGHA relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 anEPSS 3.4%CVE-2022-20754CRITICALCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 3.3%CVE-2022-20755CRITICALCisco Expressway Series and Cisco TelePresence Video Communication Server VulnerabilitiesEPSS 3.3%CVE-2020-27304—The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-baEPSS 3.2%CVE-2024-49062MEDIUMMicrosoft SharePoint Information Disclosure VulnerabilityEPSS 3.2%CVE-2022-2120HIGHOFFIS DCMTK Path TraversalEPSS 3.2%CVE-2025-26645HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 3.1%CVE-2023-1112MEDIUMDrag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversalEPSS 3.0%CVE-2025-26349HIGHA CWE-23 "Relative Path Traversal" in the file upload mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticatEPSS 2.9%CVE-2017-13996—A Relative Path Traversal issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The web user interface fails to prevent access toEPSS 2.8%CVE-2025-53779HIGHWindows Kerberos Elevation of Privilege VulnerabilityEPSS 2.7%CVE-2023-38185HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 2.7%CVE-2019-18338HIGHA vulnerability has been identified in Control Center Server (CCS) (All versions < V1.5.0). The Control Center Server (CCS) contains a direcEPSS 2.6%CVE-2012-6069CRITICAL3S CoDeSys Relative Path TraversalEPSS 2.6%CVE-2017-9664—In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker EPSS 2.6%