Fallos del tipo CWE-532

858 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados sensíveis (senhas, tokens, chaves criptográficas, PII) em arquivos de log que acabam acessíveis a usuários não autorizados. Isso expõe credenciais e informações críticas sem necessidade, transformando o log em vetor de ataque.

Ejemplo

Um serviço de autenticação que escreve no log: 'Usuário admin logou com senha: senhaForte123!' ou uma API que registra tokens JWT completos em caso de erro. Se alguém tiver acesso ao arquivo de log (via LFI, backup exposto ou permissões fracas), captura as credenciais.

Cómo mitigar

Nunca registre dados sensíveis: máscare ou omita senhas, tokens e chaves. Se precisar logar para debug, use aliases/hashes e remova antes de produção. Restrinja acesso aos arquivos de log (permissões Unix, encriptação) e implemente rotação/limpeza automática de logs antigos.

CVE-2021-3032MEDIUMPAN-OS: Configuration secrets for log forwarding may be logged in system logsEPSS 0.2%CVE-2024-45091MEDIUMIBM UrbanCode Deploy information disclosureEPSS 0.2%CVE-2024-11923MEDIUMSensitive Information Disclosure in Fortra Application Hub Prior to version 1.3EPSS 0.2%CVE-2024-22276MEDIUMVMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjaceEPSS 0.2%CVE-2022-27893MEDIUMThe Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.EPSS 0.2%CVE-2024-49750MEDIUMSnowflake Connector for Python has sensitive data in logsEPSS 0.2%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.2%CVE-2024-54519MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read senEPSS 0.2%CVE-2025-24034LOWHimmelblau leaks credentials in the debug logEPSS 0.2%CVE-2024-41129MEDIUMThe ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI commandEPSS 0.2%CVE-2023-29002HIGHDebug mode leaks confidential data in CiliumEPSS 0.2%CVE-2025-22246LOWCVE-2025-22246 – UAA Private Key ExposureEPSS 0.2%CVE-2025-24884MEDIUMkube-audit-rest's example logging configuration could disclose secret values in the audit logEPSS 0.2%CVE-2026-27315MEDIUMApache Cassandra: cqlsh history sensitive information leakEPSS 0.2%CVE-2024-22336MEDIUMIBM QRadar Suite information disclosureEPSS 0.2%CVE-2026-75485MEDIUMMust-gather: /tmp/kubeconfig retentionEPSS 0.2%CVE-2026-81870LOWOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsEPSS 0.2%CVE-2026-81320MEDIUMHawtio-operator: hawtio-operator: tls private key written to operator log at debug levelEPSS 0.2%CVE-2024-34353MEDIUMmatrix-sdk-crypto contains a log exposure of private key of the server-side key backupEPSS 0.2%CVE-2025-7445MEDIUMKubernetes secrets-store-sync-controller discloses service account tokens in logsEPSS 0.2%