Fallos del tipo CWE-532

858 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2024-51753LOWRefresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remixEPSS 0.2%CVE-2022-39893LOWSensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers EPSS 0.2%CVE-2024-4472MEDIUMInsertion of Sensitive Information into Log File in GitLabEPSS 0.2%CVE-2025-0736MEDIUMOrg.infinispan-infinispan-parent: exposure of sensitive information in application logsEPSS 0.2%CVE-2024-44166MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14EPSS 0.2%CVE-2022-25477MEDIUMVulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card ReadEPSS 0.2%CVE-2025-13743LOWExpired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logsEPSS 0.2%CVE-2023-30610MEDIUMAWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sendingEPSS 0.2%CVE-2024-23242LOWA privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. AnEPSS 0.2%CVE-2024-47094MEDIUMLogging of sitesecret to automations logEPSS 0.2%CVE-2024-31216MEDIUMsource-controller leaks theAzure Storage SAS token into logs on connection errorsEPSS 0.2%CVE-2025-50200MEDIUMRabbitMQ Node can log Basic Auth header from an HTTP requestEPSS 0.2%CVE-2023-30618LOWSensitive Terraform Output Values Printed At Info Logging Level In Kitchen-TerraformEPSS 0.2%CVE-2026-59300LOWPotential for logging sensitive data in Spring Cloud Function AWSEPSS 0.2%CVE-2023-5182MEDIUMSensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information toEPSS 0.2%CVE-2023-45585LOWAn insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.EPSS 0.2%CVE-2026-46358MEDIUMOpenBao's Inline Auth Incorrectly Redacted HeadersEPSS 0.2%CVE-2026-73442LOWOn affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forEPSS 0.2%CVE-2025-43225MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, mEPSS 0.2%CVE-2026-9073MEDIUMForeman-mcp-server: mcp server: insecure sensitive http header sanitizationEPSS 0.2%