Falhas do tipo CWE-532

941 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2024-29959HIGHBrocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support saveEPSS 0.5%CVE-2023-22481MEDIUMSensitive information exposure in the logs of greader API in FreshRSSEPSS 0.5%CVE-2025-59355MEDIUMApache Linkis: Password ExposureEPSS 0.5%CVE-2024-30511MEDIUMWordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%CVE-2024-31353MEDIUMWordPress Slideshow Gallery LITE plugin <= 1.7.8 - Sensitive Data Exposure vulnerabilityEPSS 0.5%CVE-2024-30514MEDIUMWordPress Paid Memberships Pro – Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.5%CVE-2024-8609HIGHImproper Access Control in Oceanic Software's ValeAppEPSS 0.5%CVE-2024-23758HIGHAn issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.loEPSS 0.5%CVE-2025-11008CRITICALCE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS 0.5%CVE-2020-8564MEDIUMDocker config secrets leaked when file is malformed and loglevel >= 4EPSS 0.5%CVE-2025-54064MEDIUMrucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfilesEPSS 0.5%CVE-2023-32468MEDIUM Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious EPSS 0.5%CVE-2025-59203MEDIUMWindows State Repository API Server File Information Disclosure VulnerabilityEPSS 0.5%CVE-2025-59197MEDIUMWindows ETL Channel Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-9699MEDIUMMattermost Agents plugin logs unsanitized OpenAI API keys on authentication errorsEPSS 0.5%CVE-2022-38133LOWIn JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some casesEPSS 0.5%CVE-2025-53886MEDIUMDirectus doesn't redact tokens in Flow logsEPSS 0.5%CVE-2026-85857MEDIUMWindows Kernel-Mode Drivers Information Disclosure VulnerabilityEPSS 0.5%CVE-2026-65311MEDIUMMissing authentication for logging-configuration endpointEPSS 0.5%CVE-2024-8365MEDIUMVault Leaks AppRole Client Tokens And Accessor in Audit LogEPSS 0.5%