Falhas do tipo CWE-532

850 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2023-44483—Apache Santuario: Private Key disclosure in debug-log outputEPSS 1.2%CVE-2023-46215HIGHApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendEPSS 1.2%CVE-2024-0716LOWByzoro Smart S150 Management Platform Backup File download.php information disclosureEPSS 1.2%CVE-2021-25009—CorreosExpress <= 2.6.0 - Sensitive Information DisclosureEPSS 1.2%CVE-2026-24308MEDIUMApache ZooKeeper: Sensitive information disclosure in client configuration handlingEPSS 1.2%CVE-2021-21361MEDIUMSensitive information disclosure via log in com.bmuschko:gradle-vagrant-pluginEPSS 1.2%CVE-2019-13515—OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.EPSS 1.2%CVE-2025-25002MEDIUMAzure Local Cluster Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-31047MEDIUMInsertion of Sensitive Information into Log File in typo3/cms-coreEPSS 1.1%CVE-2022-24758HIGHInsertion of Sensitive Information into Log File affects Jupyter NotebookEPSS 1.1%CVE-2019-11292HIGHPivotal Ops Manager logs query parameters in tomcat access fileEPSS 1.1%CVE-2024-34706CRITICAL@valtimo/components exposes access token to form.ioEPSS 1.1%CVE-2020-11094MEDIUMPotential unauthorized access to stored request & session data when plugin is misconfigured in October CMS DebugbarEPSS 1.0%CVE-2020-3281MEDIUMCisco Digital Network Architecture Center Information Disclosure VulnerabilityEPSS 1.0%CVE-2019-11273LOWPKS Telemetry logs credentialsEPSS 1.0%CVE-2018-3827—A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the reposEPSS 1.0%CVE-2020-11646MEDIUMGateManager Log Information Disclosure VulnerabilityEPSS 1.0%CVE-2025-31139MEDIUMIn JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logEPSS 1.0%CVE-2025-46432MEDIUMIn JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsEPSS 1.0%CVE-2021-22030—In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) infoEPSS 1.0%