Falhas do tipo CWE-532

939 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2022-24757HIGHSensitive Auth & Cookie data stored in Jupyter server logsEPSS 1.3%CVE-2022-31098CRITICALWeave GitOps leaked cluster credentials into logs on connection errorsEPSS 1.3%CVE-2024-52940HIGHAnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network trafficEPSS 1.3%CVE-2025-24362HIGHCodeQL GitHub Action failed workflow writes GitHub PAT to debug artifactsEPSS 1.2%CVE-2024-0716LOWByzoro Smart S150 Management Platform Backup File download.php information disclosureEPSS 1.2%CVE-2021-25009—CorreosExpress <= 2.6.0 - Sensitive Information DisclosureEPSS 1.2%CVE-2021-21361MEDIUMSensitive information disclosure via log in com.bmuschko:gradle-vagrant-pluginEPSS 1.2%CVE-2022-31047MEDIUMInsertion of Sensitive Information into Log File in typo3/cms-coreEPSS 1.1%CVE-2025-25002MEDIUMAzure Local Cluster Information Disclosure VulnerabilityEPSS 1.1%CVE-2022-24758HIGHInsertion of Sensitive Information into Log File affects Jupyter NotebookEPSS 1.1%CVE-2023-44155MEDIUMSensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35EPSS 1.1%CVE-2016-10362—Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth creEPSS 1.1%CVE-2019-11292HIGHPivotal Ops Manager logs query parameters in tomcat access fileEPSS 1.1%CVE-2024-34706CRITICAL@valtimo/components exposes access token to form.ioEPSS 1.1%CVE-2020-3281MEDIUMCisco Digital Network Architecture Center Information Disclosure VulnerabilityEPSS 1.0%CVE-2025-31139MEDIUMIn JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build logEPSS 1.0%CVE-2020-11094MEDIUMPotential unauthorized access to stored request & session data when plugin is misconfigured in October CMS DebugbarEPSS 1.0%CVE-2019-11273LOWPKS Telemetry logs credentialsEPSS 1.0%CVE-2025-46432MEDIUMIn JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsEPSS 1.0%CVE-2018-3817—When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive informatioEPSS 1.0%