Falhas do tipo CWE-532

939 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2025-68675HIGHApache Airflow: proxy credentials for various providers might leak in task logsEPSS 1.9%CVE-2019-14864MEDIUMAnsible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it EPSS 1.9%CVE-2025-14437HIGHHummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log FileEPSS 1.8%CVE-2019-10195MEDIUMA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 1.8%CVE-2019-11250MEDIUMKubernetes client-go logs authorization headers at debug verbosity levelsEPSS 1.8%CVE-2023-46215HIGHApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendEPSS 1.6%CVE-2024-47083HIGHPower Platform Terraform Provider has Improper Masking of Secrets in LogsEPSS 1.6%CVE-2023-44483—Apache Santuario: Private Key disclosure in debug-log outputEPSS 1.5%CVE-2018-1241—Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP paEPSS 1.5%CVE-2019-1953MEDIUMCisco Enterprise NFV Infrastructure Software Password Recovery VulnerabilityEPSS 1.5%CVE-2020-7021—Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is EPSS 1.5%CVE-2019-11283HIGHPassword leak in smbdriver logsEPSS 1.5%CVE-2018-1117MEDIUMovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManaEPSS 1.4%CVE-2020-14518MEDIUMPhilips DreamMapper Insertion of Sensitive Information into Log FileEPSS 1.3%CVE-2023-34223MEDIUMIn JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some casesEPSS 1.3%CVE-2019-11293HIGHUAA logs all query parameters with debug logging levelEPSS 1.3%CVE-2026-24308MEDIUMApache ZooKeeper: Sensitive information disclosure in client configuration handlingEPSS 1.3%CVE-2020-11643MEDIUMGateManager Information Disclosure VulnerabilityEPSS 1.3%CVE-2019-13515—OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.EPSS 1.3%CVE-2019-11290HIGHCloud Foundry UAA logs query parameters in tomcat access fileEPSS 1.3%