Falhas do tipo CWE-532

850 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2024-27156MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27157MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27097MEDIUMPotential log injection in reset user endpoint in ckanEPSS 0.4%CVE-2026-32218MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-52146MEDIUMWordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data ExposureEPSS 0.4%CVE-2026-23493HIGHPimcore ENV Variables and Cookie Informations are exposed in http_error_logEPSS 0.4%CVE-2022-38133LOWIn JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some casesEPSS 0.4%CVE-2025-32054LOWIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileEPSS 0.4%CVE-2024-22440MEDIUMHPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive InformationEPSS 0.4%CVE-2026-22098CRITICALSensitive information is written to logsEPSS 0.4%CVE-2025-27391MEDIUMApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logEPSS 0.4%CVE-2020-10750HIGHSensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store EPSS 0.4%CVE-2018-20105MEDIUMyast2-rmt exposes CA private key passhrase in log-fileEPSS 0.4%CVE-2022-20651MEDIUMCisco Adaptive Security Device Manager Information Disclosure VulnerabilityEPSS 0.4%CVE-2019-14858HIGHA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramEPSS 0.4%CVE-2021-3791MEDIUMAn information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atEPSS 0.4%CVE-2026-32215MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25095HIGHWordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2026-32217MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2020-10763—An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with localEPSS 0.4%