Falhas do tipo CWE-552

398 resultados

Arquivos ou diretórios acessíveis a terceiros

A aplicação ou servidor expõe arquivos ou diretórios com permissões insuficientes, permitindo que usuários não autorizados (locais ou remotos) leiam, modifiquem ou executem conteúdo sensível. O risco varia desde exposição de dados confidenciais até execução de código malicioso, dependendo do que está exposto e das permissões concedidas.

Exemplo

Um servidor web servindo a pasta /uploads com permissões 777, onde backup de banco de dados ou chaves privadas ficam armazenadas. Qualquer pessoa com acesso à rede (ou internet, se o servidor estiver exposto) consegue baixar esses arquivos. Outro cenário: arquivo de configuração com credenciais legível por todos em /etc/app/config.txt.

Como mitigar

Implemente o princípio do menor privilégio: defina permissões de arquivo e diretório restritivas (ex: 640, 750), revise listas de controle de acesso (ACLs), separe dados sensíveis de diretórios servidos publicamente, e audite regularmente permissões em produção usando ferramentas de varredura (find, stat, ou análise de ACLs).

CVE-2026-73705HIGHAuthenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric ComposerEPSS 0.6%CVE-2023-34316MEDIUMDelta Electronics InfraSuite Device Master Improper Access ControlEPSS 0.6%CVE-2024-22240MEDIUMAria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerabilitEPSS 0.6%CVE-2019-25709CRITICALCF Image Hosting Script 1.6.5 Unauthorized Database AccessEPSS 0.6%CVE-2025-2147MEDIUMBeijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System file accessEPSS 0.6%CVE-2024-2759HIGHImproper access control in Apaczka plugin for PrestaShopEPSS 0.6%CVE-2023-1246HIGHFiles or Directories Accessible to External Parties in Saysis StarcitiesEPSS 0.6%CVE-2022-28283MEDIUMThe sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or otheEPSS 0.6%CVE-2023-26948HIGHonekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.EPSS 0.6%CVE-2025-1982HIGHLocal File Inclusion in Ready_EPSS 0.6%CVE-2024-43660HIGHArbitrary file download using <redacted>.shEPSS 0.6%CVE-2023-48661MEDIUM Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges couEPSS 0.6%CVE-2025-66689MEDIUMA path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the systEPSS 0.6%CVE-2025-4909MEDIUMSourceCodester Client Database Management System exposure of information through directory listingEPSS 0.6%CVE-2026-6418MEDIUMPaperCut NG/MF: Path Traversal in Shared Account SynchronizationEPSS 0.6%CVE-2026-68831MEDIUMWindows Defender Firewall Service Information Disclosure VulnerabilityEPSS 0.6%CVE-2023-3712MEDIUMPotential user privilege escalationEPSS 0.6%CVE-2026-75164MEDIUMAn arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authentiEPSS 0.6%CVE-2025-34139HIGHSitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File ReadEPSS 0.5%CVE-2026-67402CRITICALAn insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual hoEPSS 0.5%