Fallos del tipo CWE-23

509 resultados

Travessia de diretório via normalização de caminho inadequada

A aplicação constrói caminhos de arquivo usando entrada do usuário sem neutralizar sequências como '..' (parent directory), permitindo acesso a arquivos fora do diretório restrito pretendido. Mesmo com validações parciais, um atacante consegue contorná-las usando variações de codificação ou normalização diferida.

Ejemplo

Um sistema de gerenciamento de documentos valida se o arquivo solicitado começa com '/uploads/', mas não normaliza '..' antes da validação. Requisição GET /document?file=/uploads/../../../etc/passwd permite ler /etc/passwd. O '..' é processado após a validação passar.

Cómo mitigar

Normalize o caminho completo (resolver symlinks, '..' e '.') ANTES de qualquer validação, depois verifique se o resultado está dentro do diretório permitido. Use APIs seguras da linguagem (realpath em C, Path.getCanonicalPath em Java, Path.resolve e comparação em Python) e sempre implemente validação com whitelist, não blacklist de caracteres.

CVE-2023-20040MEDIUMA vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause aEPSS 1.2%CVE-2021-41152HIGHPath Traversal in Folder Component Leading to Local File InclusionEPSS 1.2%CVE-2022-3162MEDIUMUnauthorized read of Custom ResourcesEPSS 1.2%CVE-2025-2007HIGHImport Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 1.2%CVE-2022-28814CRITICALPath traversal in Carlo Gavazzi UWP 3.0 could lead to full device accessEPSS 1.2%CVE-2025-27610HIGHLocal File Inclusion in Rack::StaticEPSS 1.1%CVE-2021-29100HIGHArcGIS Earth has a File Parsing Directory Traversal VulnerabilityEPSS 1.1%CVE-2021-22870—Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read accessEPSS 1.1%CVE-2021-24035—A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 EPSS 1.1%CVE-2021-34594MEDIUMBeckhoff: Relative path traversal vulnerability through TwinCAT OPC UA ServerEPSS 1.1%CVE-2020-7376HIGHRapid7 Metasploit Framework Relative Path Traversal in enum_osx moduleEPSS 1.1%CVE-2023-1044MEDIUMMuYuCMS index.php path traversalEPSS 1.1%CVE-2020-1904—A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directoEPSS 1.1%CVE-2022-22279—A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versionEPSS 1.1%CVE-2025-32409HIGHRatta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) cEPSS 1.1%CVE-2026-52813CRITICALGogs: Path Traversal in organization name results in RCE through Git hooksEPSS 1.1%CVE-2022-2922MEDIUMRelative Path Traversal in dnnsoftware/dnn.platformEPSS 1.1%CVE-2021-32949HIGHMDT AutoSave Relative Path TraversalEPSS 1.1%CVE-2021-22674—The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and direEPSS 1.1%CVE-2023-37913CRITICALorg.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterEPSS 1.1%