Fallos del tipo CWE-532

850 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2025-24556HIGHWordPress MooWoodle plugin <= 3.2.4 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-22782LOWRustFS RPC signature verification logs shared secretEPSS 0.5%CVE-2022-43887MEDIUMIBM Cognos Analytics information disclosureEPSS 0.5%CVE-2023-38732MEDIUMIBM Robotic Process Automation information disclosureEPSS 0.5%CVE-2020-8566MEDIUMCeph RBD adminSecrets exposed in logs when loglevel >= 4EPSS 0.5%CVE-2023-52143HIGHWordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data ExposureEPSS 0.5%CVE-2024-22464MEDIUM Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerEPSS 0.5%CVE-2021-22133—The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an applicatioEPSS 0.5%CVE-2024-31245MEDIUMWordPress ConvertKit plugin <= 2.4.5 - Email Disclosure in Log File vulnerabilityEPSS 0.5%CVE-2020-12023LOWPhilips IntelliBridge Enterprise IBE Insertion of Sensitive Information into Log FileEPSS 0.5%CVE-2023-44989HIGHWordPress CF7 Google Sheets Connector plugin <= 5.0.5 - Sensitive Data Exposure via Debug Log vulnerabilityEPSS 0.5%CVE-2024-10544MEDIUMWoo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log FilesEPSS 0.5%CVE-2026-49200CRITICALAcer Wave 7 router: Broken Access ControlEPSS 0.5%CVE-2020-8565MEDIUMIncomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9EPSS 0.5%CVE-2024-9621MEDIUMIo.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application logEPSS 0.5%CVE-2025-62208MEDIUMWindows License Manager Information Disclosure VulnerabilityEPSS 0.5%CVE-2024-23791MEDIUMUnnecessary data is written to log if issues during indexing occursEPSS 0.5%CVE-2025-62209MEDIUMWindows License Manager Information Disclosure VulnerabilityEPSS 0.5%CVE-2022-36407CRITICALInformation Exposure Vulnerability in Hitachi Disk Array SystemsEPSS 0.5%CVE-2019-14846HIGHIn Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG EPSS 0.5%