Falhas do tipo CWE-22

5.840 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2019-5447—A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.EPSS 1.5%CVE-2022-45867HIGHMyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achEPSS 1.5%CVE-2024-34313CRITICALAn issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.EPSS 1.5%CVE-2016-10561—Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a directory traversal vulnEPSS 1.5%CVE-2020-7535—A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web EPSS 1.5%CVE-2024-28698CRITICALDirectory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted scripEPSS 1.5%CVE-2023-36827HIGHFides vulnerable to Path Traversal in Webserver APIEPSS 1.5%CVE-2024-9415HIGHPath Traversal in transformeroptimus/superagiEPSS 1.5%CVE-2019-5438—Path traversal using symlink in npm harp module versions <= 0.29.0.EPSS 1.5%CVE-2021-42542HIGHEmerson WirelessHART GatewayEPSS 1.5%CVE-2022-33164HIGHIBM Security Directory Server path traversalEPSS 1.5%CVE-2022-47027CRITICALTimmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionarEPSS 1.5%CVE-2023-27066MEDIUMDirectory Traversal vulnerability in Site Core Experience Platform 10.2 and earlier allows authenticated remote attackers to download arbitrEPSS 1.5%CVE-2018-3713—angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a maEPSS 1.5%CVE-2023-42000CRITICALArcserve UDP Agent Unauthenticated Path Traversal File Upload EPSS 1.5%CVE-2022-36327MEDIUMPath traversal vulnerability leading to an arbitrary file write in Western Digital devicesEPSS 1.5%CVE-2023-26578HIGHArbitrary File Upload to Web Root In IDAttend’s IDWeb ApplicationEPSS 1.5%CVE-2022-27620MEDIUMImproper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology SSO Server befoEPSS 1.5%CVE-2022-33897MEDIUMA directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted netwoEPSS 1.5%CVE-2024-9224MEDIUMHello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File ReadEPSS 1.5%