Falhas do tipo CWE-532

851 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2023-46255MEDIUM`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedEPSS 0.4%CVE-2024-23677MEDIUMServer Response Disclosure in RapidDiag Salesforce.com Log FileEPSS 0.4%CVE-2026-11820MEDIUMCommunity.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query stringEPSS 0.4%CVE-2022-43772LOWHitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File EPSS 0.4%CVE-2026-19363MEDIUMlmammino oidc-authorizer Lambda Authorizer handler.rs log fileEPSS 0.4%CVE-2019-3830MEDIUMA vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuratiEPSS 0.4%CVE-2023-46230HIGHSensitive Information Disclosure to Internal Log Files in Splunk Add-on BuilderEPSS 0.4%CVE-2023-51702MEDIUMApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceEPSS 0.4%CVE-2019-10165LOWOpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenSEPSS 0.4%CVE-2026-15737MEDIUMSensitive content disclosure via OpenTelemetry spans in AgentCore Python SDKEPSS 0.4%CVE-2023-39348MEDIUMImproper log output when using GitHub Status Notifications in spinnakerEPSS 0.4%CVE-2026-20144MEDIUMSensitive Information Disclosure in ''_internal'' index in Splunk EnterpriseEPSS 0.4%CVE-2024-21668MEDIUMInsertion of Sensitive Information into Log File in react-native-mmkvEPSS 0.4%CVE-2026-54704MEDIUMOpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text PasswordsEPSS 0.4%CVE-2026-0207HIGHSensitive Information Logging Vulnerability in FlashBladeEPSS 0.4%CVE-2025-32382LOWSnowflake credentials logged by the Metabase backendEPSS 0.4%CVE-2024-43444HIGHPasswords are written to Admin Log ModuleEPSS 0.4%CVE-2025-0071MEDIUMInformation Disclosure vulnerability in SAP Web Dispatcher and Internet Communication ManagerEPSS 0.4%CVE-2020-36876HIGHReQuest Serious Play F3 Media Server <= 7.0.3 Debug Log Disclosure2020EPSS 0.4%CVE-2023-2878MEDIUMKubernetes secrets-store-csi-driver discloses service account tokens in logsEPSS 0.4%