Falhas do tipo CWE-117

135 resultados

Injeção em logs (Log Injection)

O software escreve dados não sanitizados nos logs, permitindo que um atacante injete conteúdo malicioso (quebras de linha, caracteres de controle, formatação falsa) que pode ser interpretado como eventos legítimos, mascarar atividades suspeitas ou enganar ferramentas de monitoramento.

Exemplo

Um servidor web registra a URL solicitada diretamente no log sem filtrar quebras de linha. Um atacante envia requisição com payload como `/page?id=123%0aAdmin login failed`, que escreve nos logs como se fosse dois eventos separados, ocultando a atividade real ou imitando um acesso autorizado.

Como mitigar

Sanitize todos os dados antes de escrever em logs: remova ou escape caracteres de controle (\n, \r, \0), use formatação estruturada (JSON, syslog) em vez de concatenação de strings, e implemente validação rigorosa de entrada. Ferramentas de SIEM devem também rejeitar logs com estrutura inesperada.

CVE-2026-12616MEDIUMThe /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled, then interpolates tEPSS 0.5%CVE-2024-0095MEDIUMCVEEPSS 0.5%CVE-2024-22356MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosureEPSS 0.5%CVE-2026-111211MEDIUMPotential log injection via unescaped geometry form valuesEPSS 0.5%CVE-2024-8297MEDIUMkitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logsEPSS 0.5%CVE-2026-93421MEDIUMMesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointEPSS 0.5%CVE-2024-52962MEDIUMAn Improper Output Neutralization for Logs vulnerability [CWE-117] in FortiAnalyzer version 7.6.1 and below, version 7.4.5 and below, versioEPSS 0.5%CVE-2019-14846HIGHIn Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG EPSS 0.5%CVE-2024-12580MEDIUMLogs Debug Injection in danny-avila/librechatEPSS 0.5%CVE-2024-9026LOWPHP-FPM logs from children may be alteredEPSS 0.5%CVE-2026-44256MEDIUMWazuh: CRLF Log Injection via Unsanitized Basic-Auth UsernameEPSS 0.5%CVE-2024-8334MEDIUMmaster-nan Sweet-CMS log.go LogHandler neutralization for logsEPSS 0.5%CVE-2023-46713MEDIUMAn improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may alEPSS 0.5%CVE-2026-54511HIGH@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keysEPSS 0.5%CVE-2023-36924MEDIUMLog Injection vulnerability in SAP ERP Defense Forces and Public SecurityEPSS 0.5%CVE-2023-31405MEDIUMLog Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)EPSS 0.4%CVE-2024-31845MEDIUMAn issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs.EPSS 0.4%CVE-2023-37275LOWSystem logs spoofable in Auto-GPT via ANSI control sequencesEPSS 0.4%CVE-2026-10745HIGHImproper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log InjectioEPSS 0.4%CVE-2024-32474HIGHSentry's superuser cleartext password leaked in logsEPSS 0.4%