Falhas do tipo CWE-552

398 resultados

Arquivos ou diretórios acessíveis a terceiros

A aplicação ou servidor expõe arquivos ou diretórios com permissões insuficientes, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo sensível. O risco varia desde exposição de dados confidenciais até execução de código malicioso, dependendo do que está exposto e das permissões concedidas.

Exemplo

Um servidor web servindo a pasta /uploads com permissões 777, onde backup de banco de dados ou chaves privadas ficam armazenadas. Qualquer pessoa com acesso à rede (ou internet, se o servidor estiver exposto) consegue baixar esses arquivos. Outro cenário: arquivo de configuração com credenciais legível por todos em /etc/app/config.txt.

Como mitigar

Implemente o princípio do menor privilégio: defina permissões de arquivo e diretório restritivas (ex: 640, 750), revise listas de controle de acesso (ACLs), separe dados sensíveis de diretórios servidos publicamente, e audite regularmente permissões em produção usando ferramentas de varredura (find, stat, ou análise de ACLs).

CVE-2024-39581HIGHDell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. An unautheEPSS 0.4%CVE-2026-74853MEDIUMPods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display CallbackEPSS 0.4%CVE-2026-105750MEDIUMDocling: `enable_local_fetch` is not enforced in HTML browser-rendering modeEPSS 0.4%CVE-2026-34785HIGHRack: Local file inclusion in `Rack::Static` via URL Prefix MatchingEPSS 0.4%CVE-2022-41710MEDIUMMarkdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicioEPSS 0.4%CVE-2025-9273MEDIUMCData API Server MySQL Misconfiguration Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-57452HIGHChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete EPSS 0.4%CVE-2024-10126MEDIUMLocal file inclusion vulnerability in M-Files ServerEPSS 0.4%CVE-2024-11629HIGHTelerik Document Processing RTF Export of Arbitrary File PathEPSS 0.4%CVE-2026-96857MEDIUMWindows Projected File System Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-46651CRITICALUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerEPSS 0.4%CVE-2025-58753MEDIUMcopyparty: Sharing a single file does not fully restrict access to other files in source folderEPSS 0.4%CVE-2026-40425MEDIUMMacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External PartiesEPSS 0.4%CVE-2026-15342MEDIUMCVE-2026-15342EPSS 0.4%CVE-2017-2622MEDIUMAn accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readableEPSS 0.4%CVE-2025-45529HIGHAn arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sendiEPSS 0.4%CVE-2026-109162MEDIUMTYPO3 CMS - Security Misconfiguration in Form FrameworkEPSS 0.4%CVE-2026-61730CRITICALSOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static MountEPSS 0.4%CVE-2025-37177MEDIUMAuthenticated Arbitrary File Deletion Vulnerability in AOS-10 or AOS-8 Command Line Interface (CLI)EPSS 0.4%CVE-2026-33380MEDIUMSQL Expressions Read File From DiskEPSS 0.4%