Falhas do tipo CWE-532

858 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2021-3032MEDIUMPAN-OS: Configuration secrets for log forwarding may be logged in system logsEPSS 0.2%CVE-2024-45091MEDIUMIBM UrbanCode Deploy information disclosureEPSS 0.2%CVE-2024-11923MEDIUMSensitive Information Disclosure in Fortra Application Hub Prior to version 1.3EPSS 0.2%CVE-2024-22276MEDIUMVMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjaceEPSS 0.2%CVE-2022-27893MEDIUMThe Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.EPSS 0.2%CVE-2024-49750MEDIUMSnowflake Connector for Python has sensitive data in logsEPSS 0.2%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.2%CVE-2024-54519MEDIUMThe issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read senEPSS 0.2%CVE-2025-24034LOWHimmelblau leaks credentials in the debug logEPSS 0.2%CVE-2024-41129MEDIUMThe ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI commandEPSS 0.2%CVE-2023-29002HIGHDebug mode leaks confidential data in CiliumEPSS 0.2%CVE-2025-22246LOWCVE-2025-22246 – UAA Private Key ExposureEPSS 0.2%CVE-2025-24884MEDIUMkube-audit-rest's example logging configuration could disclose secret values in the audit logEPSS 0.2%CVE-2026-27315MEDIUMApache Cassandra: cqlsh history sensitive information leakEPSS 0.2%CVE-2024-22336MEDIUMIBM QRadar Suite information disclosureEPSS 0.2%CVE-2026-75485MEDIUMMust-gather: /tmp/kubeconfig retentionEPSS 0.2%CVE-2026-81870LOWOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsEPSS 0.2%CVE-2026-81320MEDIUMHawtio-operator: hawtio-operator: tls private key written to operator log at debug levelEPSS 0.2%CVE-2024-34353MEDIUMmatrix-sdk-crypto contains a log exposure of private key of the server-side key backupEPSS 0.2%CVE-2025-7445MEDIUMKubernetes secrets-store-sync-controller discloses service account tokens in logsEPSS 0.2%