Falhas do tipo CWE-200

5.714 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2019-0202—The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versionEPSS 2.0%CVE-2021-20228—A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature whenEPSS 2.0%CVE-2021-44702LOWAdobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) for Internet Explorer LoadFile NTLMv2 SSO Auth leak vulnerabilityEPSS 2.0%CVE-2021-44739LOWAdobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Auth leak vulnerabilityEPSS 2.0%CVE-2024-1210MEDIUMLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via APIEPSS 2.0%CVE-2017-6651—A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to acEPSS 2.0%CVE-2023-40600MEDIUMWordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data ExposureEPSS 2.0%CVE-2023-42663—Apache Airflow: Bypass permission verification to view task instances of other dagsEPSS 2.0%CVE-2021-21817HIGHAn information disclosure vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially craftedEPSS 2.0%CVE-2020-24406LOWDocument root path disclosure on Maintenance pageEPSS 2.0%CVE-2023-40712—Apache Airflow: Secrets can be unmasked in the "Rendered Template" EPSS 2.0%CVE-2019-1908HIGHCisco Integrated Management Controller Information Disclosure VulnerabilityEPSS 2.0%CVE-2021-41767—Private tunnel identifier may be included in the non-private details of active connectionsEPSS 2.0%CVE-2022-21673MEDIUMOAuth Identity Token exposure in GrafanaEPSS 2.0%CVE-2022-31042HIGHFailure to strip the Cookie header on change in host or HTTP downgrade in GuzzleEPSS 2.0%CVE-2022-31043HIGHFix failure to strip Authorization header on HTTP downgrade in GuzzleEPSS 2.0%CVE-2021-41301CRITICALECOA BAS controller - Exposure of Sensitive Information to an Unauthorized ActorEPSS 2.0%CVE-2018-3831—Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured viEPSS 2.0%CVE-2022-27949HIGHApache Airflow prior to 2.3.1 may include sensitive values in rendered templateEPSS 2.0%CVE-2020-12802—remote graphics contained in docx format retrieved in 'stealth mode'EPSS 2.0%