Falhas do tipo CWE-532

858 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2024-51753LOWRefresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remixEPSS 0.2%CVE-2022-39893LOWSensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers EPSS 0.2%CVE-2024-4472MEDIUMInsertion of Sensitive Information into Log File in GitLabEPSS 0.2%CVE-2025-0736MEDIUMOrg.infinispan-infinispan-parent: exposure of sensitive information in application logsEPSS 0.2%CVE-2024-44166MEDIUMA privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14EPSS 0.2%CVE-2022-25477MEDIUMVulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card ReadEPSS 0.2%CVE-2025-13743LOWExpired Personal Access Tokens (PATs) are recorded in Docker Desktop diagnostic logsEPSS 0.2%CVE-2023-30610MEDIUMAWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sendingEPSS 0.2%CVE-2024-23242LOWA privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. AnEPSS 0.2%CVE-2024-47094MEDIUMLogging of sitesecret to automations logEPSS 0.2%CVE-2024-31216MEDIUMsource-controller leaks theAzure Storage SAS token into logs on connection errorsEPSS 0.2%CVE-2025-50200MEDIUMRabbitMQ Node can log Basic Auth header from an HTTP requestEPSS 0.2%CVE-2023-30618LOWSensitive Terraform Output Values Printed At Info Logging Level In Kitchen-TerraformEPSS 0.2%CVE-2026-59300LOWPotential for logging sensitive data in Spring Cloud Function AWSEPSS 0.2%CVE-2023-5182MEDIUMSensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information toEPSS 0.2%CVE-2023-45585LOWAn insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.EPSS 0.2%CVE-2026-46358MEDIUMOpenBao's Inline Auth Incorrectly Redacted HeadersEPSS 0.2%CVE-2026-73442LOWOn affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forEPSS 0.2%CVE-2025-43225MEDIUMA logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, mEPSS 0.2%CVE-2026-9073MEDIUMForeman-mcp-server: mcp server: insecure sensitive http header sanitizationEPSS 0.2%