Falhas do tipo CWE-552

398 resultados

Arquivos ou diretórios acessíveis a terceiros

A aplicação ou servidor expõe arquivos ou diretórios com permissões insuficientes, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo sensível. O risco varia desde exposição de dados confidenciais até execução de código malicioso, dependendo do que está exposto e das permissões concedidas.

Exemplo

Um servidor web servindo a pasta /uploads com permissões 777, onde backup de banco de dados ou chaves privadas ficam armazenadas. Qualquer pessoa com acesso à rede (ou internet, se o servidor estiver exposto) consegue baixar esses arquivos. Outro cenário: arquivo de configuração com credenciais legível por todos em /etc/app/config.txt.

Como mitigar

Implemente o princípio do menor privilégio: defina permissões de arquivo e diretório restritivas (ex: 640, 750), revise listas de controle de acesso (ACLs), separe dados sensíveis de diretórios servidos publicamente, e audite regularmente permissões em produção usando ferramentas de varredura (find, stat, ou análise de ACLs).

CVE-2025-66625MEDIUMUmbraco Vulnerable to Improper File Access and Credential Exposure through Dictionary Import FunctionalityEPSS 0.4%CVE-2024-5056MEDIUMCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and pEPSS 0.4%CVE-2025-14771HIGHFile Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web SiteEPSS 0.3%CVE-2023-47612MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, TelitEPSS 0.3%CVE-2023-4588MEDIUMFile accessibility vulnerability in Delinea Secret ServerEPSS 0.3%CVE-2025-37130MEDIUMUnrestricted Binary allows File Enumeration in Underlying Operating SystemEPSS 0.3%CVE-2024-45894MEDIUMBlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.EPSS 0.3%CVE-2025-52460MEDIUMFiles or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exEPSS 0.3%CVE-2023-52112MEDIUMUnauthorized file access vulnerability in the wallpaper service module. Successful exploitation of this vulnerability may cause features to EPSS 0.3%CVE-2026-33698CRITICALChamilo LMS affected by unauthenticated RCE in main/install folderEPSS 0.3%CVE-2022-23508HIGHGitOps Run allows for Kubernetes workload injectionEPSS 0.3%CVE-2024-41699MEDIUMPriority – CWE-552: Files or Directories Accessible to External PartiesEPSS 0.3%CVE-2024-50627HIGHAn issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file upload feature. It alEPSS 0.3%CVE-2022-1117—A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time reEPSS 0.3%CVE-2023-41566HIGHOA EKP v16 was discovered to contain an arbitrary download vulnerability via the component /ui/sys_ui_extend/sysUiExtend.do. This vulnerabilEPSS 0.3%CVE-2024-51542HIGHConfiguration DownloadEPSS 0.3%CVE-2024-45627MEDIUMApache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerabilityEPSS 0.3%CVE-2026-4760HIGHPotential unauthorized access to files on the Web HMI server hostEPSS 0.3%CVE-2025-7389HIGHUnauthorized Arbitrary File Read via RMI in AdminServer InterfaceEPSS 0.3%CVE-2026-85175HIGHSiYuan before v3.8.2 TLS Private Key Disclosure via getFileEPSS 0.3%