Falhas do tipo CWE-117

121 resultados

Injeção em logs (Log Injection)

O software escreve dados não sanitizados nos logs, permitindo que um atacante injete conteúdo malicioso (quebras de linha, caracteres de controle, formatação falsa) que pode ser interpretado como eventos legítimos, mascarar atividades suspeitas ou enganar ferramentas de monitoramento.

Exemplo

Um servidor web registra a URL solicitada diretamente no log sem filtrar quebras de linha. Um atacante envia requisição com payload como `/page?id=123%0aAdmin login failed`, que escreve nos logs como se fosse dois eventos separados, ocultando a atividade real ou imitando um acesso autorizado.

Como mitigar

Sanitize todos os dados antes de escrever em logs: remova ou escape caracteres de controle (\n, \r, \0), use formatação estruturada (JSON, syslog) em vez de concatenação de strings, e implemente validação rigorosa de entrada. Ferramentas de SIEM devem também rejeitar logs com estrutura inesperada.

CVE-2026-45565HIGHRoxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)EPSS 0.3%CVE-2024-22229LOW Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker coEPSS 0.3%CVE-2025-36625MEDIUMLog Poisoning in NessusEPSS 0.3%CVE-2025-3942MEDIUMImproper Output Neutralization for LogsEPSS 0.3%CVE-2025-10217MEDIUMA vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject craftEPSS 0.3%CVE-2023-3997HIGHUnauthenticated Log Injection In Splunk SOAREPSS 0.3%CVE-2025-59784MEDIUMLog Pollution - Control Characters Not EscapedEPSS 0.3%CVE-2025-23405MEDIUMDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For LogsEPSS 0.3%CVE-2024-35150MEDIUMIBM Maximo Application Suite log manipulationEPSS 0.3%CVE-2024-56473MEDIUMIBM Aspera Shares Data ManipulationEPSS 0.3%CVE-2024-49355MEDIUMIBM OpenPages log manipulationEPSS 0.3%CVE-2025-25294MEDIUMEnvoy Gateway Log Injection VulnerabilityEPSS 0.3%CVE-2026-16188MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2025-66577MEDIUMcpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP TrustEPSS 0.3%CVE-2025-0754MEDIUMEnvoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofingEPSS 0.3%CVE-2026-9016MEDIUMDebug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX ActionEPSS 0.3%CVE-2024-52891MEDIUMIBM Concert Software log manipulationEPSS 0.3%CVE-2023-4571HIGHUnauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)EPSS 0.3%CVE-2023-4065MEDIUMOperator: plaintext password in operator logEPSS 0.2%CVE-2023-1711MEDIUMA vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elemEPSS 0.2%