Fallos del tipo CWE-552

365 resultados

Arquivos ou diretórios acessíveis a partes externas

Ocorre quando arquivos ou diretórios sensíveis são deixados com permissões inadequadas, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo que deveria estar protegido. O erro típico é confiar em permissões padrão do sistema ou definir chmod/ACL incorretamente, expondo dados críticos como credenciais, configurações ou código.

Ejemplo

Um aplicativo salva chaves SSH ou tokens de API em ~/.ssh/config ou /etc/app/secrets.conf com permissão 644 (legível por qualquer usuário), ou um servidor web expõe um diretório de backup (.bak, .sql) sem autenticação. Um atacante local ou remoto consegue acessar diretamente esses arquivos e comprometer a segurança.

Cómo mitigar

Defina permissões restritivas no momento da criação (umask correto, chmod 600 para arquivos sensíveis, 700 para diretórios) e use ACLs/SELinux quando necessário. Valide permissões em testes, esconda backups e arquivos temporários fora do diretório web, e implemente verificações de acesso no código antes de servir qualquer recurso.

CVE-2017-2622MEDIUMAn accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readableEPSS 0.4%CVE-2025-58753MEDIUMcopyparty: Sharing a single file does not fully restrict access to other files in source folderEPSS 0.4%CVE-2025-37177MEDIUMAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)EPSS 0.4%CVE-2025-66625MEDIUMUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityEPSS 0.4%CVE-2026-33380MEDIUMSQL Expressions Read File From DiskEPSS 0.4%CVE-2024-5056MEDIUMCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and pEPSS 0.4%CVE-2026-37065CRITICALVeno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=.EPSS 0.4%CVE-2026-73705HIGHAuthenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.3%CVE-2025-45529HIGHAn arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sendiEPSS 0.3%CVE-2025-14771HIGHFile Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteEPSS 0.3%CVE-2023-47612MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, TelitEPSS 0.3%CVE-2026-4760HIGHPotential unauthorized access to files on the Web HMI server hostEPSS 0.3%CVE-2023-4588MEDIUMFile accessibility vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2026-8715CRITICALVault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPathEPSS 0.3%CVE-2025-52460MEDIUMFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exEPSS 0.3%CVE-2023-52112MEDIUMUnauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to EPSS 0.3%CVE-2024-45894MEDIUMBlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.EPSS 0.3%CVE-2024-41699MEDIUMPriority – CWE-552: Files or Directories Accessible to External PartiesEPSS 0.3%CVE-2024-50627HIGHAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It alEPSS 0.3%CVE-2026-82020HIGHHermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write ToolEPSS 0.3%