Falhas do tipo CWE-532

925 resultados

Informações sensíveis em arquivos de log

A aplicação registra dados confidenciais (senhas, tokens, PII, chaves criptográficas) em arquivos de log sem proteção adequada. Esses logs são frequentemente legíveis por outros usuários do sistema, backups desprotegidos ou ferramentas de análise, expondo segredos de negócio e credenciais de autenticação.

Exemplo

Uma API registra a requisição HTTP completa incluindo o header `Authorization: Bearer eyJhbGc...`, ou um serviço de login escreve a senha do usuário em log de debug antes de validá-la. Um atacante com acesso ao servidor (ou backups antigos) lê esses logs e obtém credenciais válidas.

Como mitigar

Nunca registre senhas, tokens, chaves, CPF ou dados de cartão. Use máscaras (ex: `token=***`) para valores sensíveis que precisam ser logados. Restrinja permissões de acesso aos arquivos de log e aplique rotação com limpeza segura de logs antigos. Implemente revisão de código e linters para detectar padrões suspeitos.

CVE-2023-25164HIGHSensitive Information leak via Script File in TinaCMSEPSS 0.7%CVE-2024-23448MEDIUMAPM Server Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2026-19363MEDIUMlmammino oidc-authorizer Lambda Authorizer handler.rs log fileEPSS 0.7%CVE-2022-34369HIGHDell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive inforEPSS 0.7%CVE-2023-49922MEDIUMBeats Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2023-46667HIGHFleet Server Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2022-44624MEDIUMIn JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special charactersEPSS 0.7%CVE-2023-22574HIGH Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI mEPSS 0.7%CVE-2020-5225MEDIUMLog injection in SimpleSAMLphpEPSS 0.7%CVE-2023-31426MEDIUMscp, sftp, ftp servers passwords in supportsaveEPSS 0.7%CVE-2023-26023MEDIUMIBM Planning Analytics Cartridge for Cloud Pak for Data information disclosureEPSS 0.7%CVE-2023-46671HIGHKibana Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2022-23716MEDIUMA flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in dEPSS 0.7%CVE-2023-41934—Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of EPSS 0.7%CVE-2026-92918HIGHadmin3 through 3.0.0 Session Token Disclosure via Audit LogEPSS 0.6%CVE-2023-25721MEDIUMVeracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and whEPSS 0.6%CVE-2024-28072MEDIUMArbitrary File Overwrite VulnerabilityEPSS 0.6%CVE-2026-65945MEDIUMApache Ranger: Logs contain replayable JWT bearer tokensEPSS 0.6%CVE-2023-20891MEDIUMVMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerabilityEPSS 0.6%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%