Falhas do tipo CWE-532

850 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2019-10212MEDIUMA flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this EPSS 1.9%CVE-2019-14864MEDIUMAnsible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it EPSS 1.9%CVE-2022-36321MEDIUMIn JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some casesEPSS 1.8%CVE-2019-10195MEDIUMA flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way thEPSS 1.8%CVE-2019-11250MEDIUMKubernetes client-go logs authorization headers at debug verbosity levelsEPSS 1.8%CVE-2024-47083HIGHPower Platform Terraform Provider has Improper Masking of Secrets in LogsEPSS 1.6%CVE-2019-1953MEDIUMCisco Enterprise NFV Infrastructure Software Password Recovery VulnerabilityEPSS 1.5%CVE-2019-11283HIGHPassword leak in smbdriver logsEPSS 1.5%CVE-2020-14518MEDIUMPhilips DreamMapper Insertion of Sensitive Information into Log FileEPSS 1.3%CVE-2023-34223MEDIUMIn JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some casesEPSS 1.3%CVE-2019-11293HIGHUAA logs all query parameters with debug logging levelEPSS 1.3%CVE-2020-7021—Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is EPSS 1.3%CVE-2018-1117MEDIUMovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManaEPSS 1.3%CVE-2020-11643MEDIUMGateManager Information Disclosure VulnerabilityEPSS 1.3%CVE-2019-11290HIGHCloud Foundry UAA logs query parameters in tomcat access fileEPSS 1.3%CVE-2018-1241—Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP paEPSS 1.3%CVE-2022-24757HIGHSensitive Auth & Cookie data stored in Jupyter server logsEPSS 1.3%CVE-2025-24362HIGHCodeQL GitHub Action failed workflow writes GitHub PAT to debug artifactsEPSS 1.2%CVE-2024-52940HIGHAnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network trafficEPSS 1.2%CVE-2022-31098CRITICALWeave GitOps leaked cluster credentials into logs on connection errorsEPSS 1.2%