Falhas do tipo CWE-532

939 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2018-3828—Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exceptiEPSS 0.6%CVE-2025-24457MEDIUMIn JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logsEPSS 0.6%CVE-2025-59258MEDIUMWindows Active Directory Federation Services (ADFS) Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-31479HIGHcanonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception outputEPSS 0.6%CVE-2023-49923MEDIUMEnterprise Search Insertion of Sensitive Information into Log FileEPSS 0.6%CVE-2023-6687MEDIUMElastic Agent Insertion of Sensitive Information into Log FileEPSS 0.6%CVE-2022-23506MEDIUMSpinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer buildsEPSS 0.6%CVE-2024-31259HIGHWordPress SearchIQ plugin <= 4.5 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.6%CVE-2024-34550MEDIUMWordPress Dynamics 365 Integration plugin <= 1.3.17 - Sensitive Data Exposure vulnerabilityEPSS 0.6%CVE-2026-66780MEDIUMSubmariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityEPSS 0.6%CVE-2024-35196LOWSlack integration leaks sensitive information in logs in SentryEPSS 0.6%CVE-2020-14330MEDIUMAn Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content aEPSS 0.6%CVE-2026-14948HIGHFrauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archivesEPSS 0.6%CVE-2024-42349MEDIUMFOG has a Log Information DisclosureEPSS 0.6%CVE-2021-36278HIGHDell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local EPSS 0.6%CVE-2026-85171HIGHn8n before 1.123.73 Credential Exposure via Error LoggingEPSS 0.6%CVE-2024-37283MEDIUMElastic Agent Insertion of Sensitive Information into Log FileEPSS 0.6%CVE-2022-43887MEDIUMIBM Cognos Analytics information disclosureEPSS 0.6%CVE-2024-0472LOWcode-projects Dormitory Management System modifyuser.php information disclosureEPSS 0.6%CVE-2023-23591MEDIUMThe Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs EPSS 0.6%