Falhas do tipo CWE-532

852 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2023-46672HIGHLogstash Insertion of Sensitive Information into Log FileEPSS 0.3%CVE-2024-28830LOWAutomation user secrets written to audit logEPSS 0.3%CVE-2019-0021HIGHJuniper ATP: secret CLI inputs are logged to /var/log/syslog in clear textEPSS 0.3%CVE-2025-13925MEDIUMMultiple vulnerabilities in IBM Aspera ConsoleEPSS 0.3%CVE-2021-3447—A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on maEPSS 0.3%CVE-2024-40596MEDIUMAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed inforEPSS 0.3%CVE-2024-40598MEDIUMAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (EPSS 0.3%CVE-2024-38460MEDIUMIn SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexEPSS 0.3%CVE-2025-62705MEDIUMOpenBao and Vault Leak []byte Fields in Audit LogsEPSS 0.3%CVE-2019-0004HIGHJuniper ATP: API and device keys are logged in a world-readable permissions fileEPSS 0.3%CVE-2026-23775HIGHDell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 releEPSS 0.3%CVE-2026-20138MEDIUMSensitive Information Disclosure in "_internal" index in Splunk EnterpriseEPSS 0.3%CVE-2025-10486MEDIUMContent Writer <= 3.6.8 - Unauthenticated Information Exposure via Log FileEPSS 0.3%CVE-2026-20142MEDIUMSensitive Information Disclosure in "_internal" index in Splunk EnterpriseEPSS 0.3%CVE-2026-85171HIGHn8n before 1.123.73 Credential Exposure via Error LoggingEPSS 0.3%CVE-2024-11193MEDIUMAn information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application EPSS 0.3%CVE-2019-3763HIGHThe RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information eEPSS 0.3%CVE-2026-49088MEDIUMInsertion of Sensitive Information into Log File in Kibana Leading to Information DisclosureEPSS 0.3%CVE-2026-41185MEDIUMServiceAccount token disclosure via Azure IPAM CNI plugin logsEPSS 0.3%CVE-2024-23210LOWThis issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.EPSS 0.3%