Falhas do tipo CWE-215

18 resultados

Inserção de informações sensíveis em código de depuração

Desenvolvedor inclui dados sensíveis (senhas, tokens, chaves API, PII) em logs, mensagens de erro ou código de debug que fica ativo em produção. Quando o sistema é capturado, reversionado ou monitorado, essas informações vazam diretamente para quem tem acesso aos logs ou à memória da aplicação.

Exemplo

Um aplicativo escreve no log: 'Conectando ao banco com user=admin password=Sec@123!' ou inclui um console.log() com o token JWT do usuário logado. Um atacante que consegue acesso ao arquivo de log ou ao processo rodando em produção extrai as credenciais e ganha acesso direto.

Como mitigar

Nunca logueie senhas, tokens ou chaves — use placeholders ou hashes. Remova ou desative todo debug de sensíveis antes de deploy (buscar hardcodes e console.log() críticos). Implemente rotação de logs com limpeza periódica e restrinja acesso a logs apenas a administradores autorizados.

CVE-2024-7569CRITICALAn information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated atEPSS 1.7%CVE-2022-0721HIGHInsertion of Sensitive Information Into Debugging Code in microweber/microweberEPSS 1.4%CVE-2019-3781HIGHCF CLI does not sanitize user's password in verbose/trace/debugEPSS 1.3%CVE-2018-1002104MEDIUMVersions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.EPSS 1.1%CVE-2018-1191—Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may bEPSS 0.9%CVE-2025-34081MEDIUMCONPROSYS HMI System (CHS) < 3.7.7 Exposed PHP Debug InfoEPSS 0.6%CVE-2025-27684HIGHVasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive DataEPSS 0.6%CVE-2025-12616MEDIUMPHPGurukul News Portal settings.py insertion of sensitive information into debugging codeEPSS 0.5%CVE-2023-49194MEDIUMWordPress Importify (Dropshipping WooCommerce) plugin <= 1.0.4 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2026-40173CRITICALDgraph: Unauthenticated pprof endpoint leaks admin auth tokenEPSS 0.5%CVE-2026-33247HIGHNATS credentials are exposed in monitoring port via command-line argvEPSS 0.4%CVE-2024-22194LOWcdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration codeEPSS 0.4%CVE-2026-2250HIGHUnauthenticated Data Export and Source Code Disclosure via /dbviewer/ in METIS WICEPSS 0.4%CVE-2023-51390MEDIUMInformation Disclosure Vulnerability in JournalpumpEPSS 0.3%CVE-2025-58598MEDIUMWordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2025-0895LOWIBM Cognos Mobile information disclosureEPSS 0.2%CVE-2023-21462MEDIUMThe sensitive information exposure vulnerability in Quick Share Agent prior to versions 3.5.14.18 in Android 12 and 3.5.16.20 in Android 13 EPSS 0.2%CVE-2026-44934HIGHExposed tokens in SUSE Rancher AI Agent logsEPSS 0.1%