Falhas do tipo CWE-552

365 resultados

Arquivos ou diretórios acessíveis a terceiros

A aplicação ou servidor expõe arquivos ou diretórios com permissões insuficientes, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo sensível. O risco varia desde exposição de dados confidenciais até execução de código malicioso, dependendo do que está exposto e das permissões concedidas.

Exemplo

Um servidor web servindo a pasta /uploads com permissões 777, onde backup de banco de dados ou chaves privadas ficam armazenadas. Qualquer pessoa com acesso à rede (ou internet, se o servidor estiver exposto) consegue baixar esses arquivos. Outro cenário: arquivo de configuração com credenciais legível por todos em /etc/app/config.txt.

Como mitigar

Implemente o princípio do menor privilégio: defina permissões de arquivo e diretório restritivas (ex: 640, 750), revise listas de controle de acesso (ACLs), separe dados sensíveis de diretórios servidos publicamente, e audite regularmente permissões em produção usando ferramentas de varredura (find, stat, ou análise de ACLs).

CVE-2025-2651MEDIUMSourceCodester Online Eyewear Shop admin exposure of information through directory listingEPSS 0.7%CVE-2025-2652MEDIUMSourceCodester Employee and Visitor Gate Pass Logging System exposure of information through directory listingEPSS 0.7%CVE-2024-24161HIGHMRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.EPSS 0.7%CVE-2022-43414MEDIUMJenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test EPSS 0.7%CVE-2025-25759HIGHAn issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion viaEPSS 0.7%CVE-2022-48094MEDIUMlmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.EPSS 0.7%CVE-2023-26956HIGHonekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.EPSS 0.7%CVE-2026-2330CRITICALCVE-2026-2330EPSS 0.7%CVE-2023-26580HIGHMissing Authentication In IDAttend’s IDWeb ApplicationEPSS 0.7%CVE-2025-53536HIGHRoo Code allows Potential Remote Code Execution via .vscode/settings.jsonEPSS 0.7%CVE-2021-22769MEDIUMA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that coulEPSS 0.7%CVE-2023-29107MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versiEPSS 0.6%CVE-2026-73653CRITICALVitest: Browser Mode provider commands bypass the file-access permission gateEPSS 0.6%CVE-2022-44343HIGHCRMEB 4.4.4 is vulnerable to Any File download.EPSS 0.6%CVE-2021-31831MEDIUMIncorrect access to deleted scripts vulnerability in McAfee DBSecEPSS 0.6%CVE-2020-15224MEDIUMSocket syscalls can leak enclave memory contents in Open EnclaveEPSS 0.6%CVE-2021-3996MEDIUMA logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.EPSS 0.6%CVE-2024-5262CRITICALProjectDiscovery Interactsh - Files or Directories Accessible to External PartiesEPSS 0.6%CVE-2021-3995—A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem.EPSS 0.6%CVE-2026-33071MEDIUMFileRise: WebDAV upload path bypasses filename validation enforced by regular uploadsEPSS 0.6%