Falhas do tipo CWE-22

6.542 resultados

Travessia de diretório (Path Traversal)

A aplicação constrói caminhos de arquivo usando entrada do usuário sem validar adequadamente, permitindo que caracteres especiais como '../' façam o caminho "sair" do diretório permitido e acessar arquivos fora da zona restrita. Isso expõe dados sensíveis ou permite manipulação de arquivos críticos do sistema.

Exemplo

Um site permite download de documentos via URL como /download?file=relatorio.pdf, mas não valida o parâmetro. Um atacante usa /download?file=../../etc/passwd para ler o arquivo de senhas do servidor, ou /download?file=../../configuracao.db para acessar a base de dados da aplicação.

Como mitigar

Valide e normalize todos os caminhos de entrada (use funções nativas como realpath ou canonicalize), implemente uma whitelist de arquivos permitidos em vez de bloquear padrões perigosos, e configure permissões de arquivo restritivas no SO. Melhor ainda: nunca construa caminhos a partir de entrada do usuário — use índices ou IDs mapeados internamente.

CVE-2022-35650—The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks rEPSS 53.7%CVE-2021-43778CRITICALPath traversal in GLPI barcode pluginEPSS 52.7%CVE-2024-41163HIGHA directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can leEPSS 52.5%CVE-2022-35919HIGHAuthenticated requests for server update admin API allows path traversal in minioEPSS 52.1%CVE-2009-1936CRITICAL_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows reEPSS 51.9%CVE-2023-25652HIGH"git apply --reject" partially-controlled arbitrary file writeEPSS 51.9%CVE-2021-20023MEDIUMSonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on thEPSS 51.7%KEVCVE-2017-16720—A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structurEPSS 50.3%CVE-2019-15980HIGHCisco Data Center Network Manager Path Traversal VulnerabilitiesEPSS 50.0%CVE-2024-46909CRITICALWhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityEPSS 48.9%CVE-2023-26802CRITICALAn issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass autheEPSS 48.7%CVE-2020-5377CRITICALDell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated rEPSS 48.6%CVE-2024-12849HIGHError Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File ReadEPSS 48.0%CVE-2022-0679—Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCEEPSS 47.8%CVE-2024-25065CRITICALApache OFBiz: Path traversal allowing authentication bypass.EPSS 47.7%CVE-2018-0258—A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary fEPSS 47.6%CVE-2016-3976HIGHDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot doEPSS 47.3%KEVCVE-2023-26255HIGHAn unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. By mEPSS 47.2%CVE-2023-47211CRITICALA directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP requeEPSS 47.0%CVE-2024-5505HIGHNETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution VulnerabilityEPSS 47.0%