Falhas do tipo CWE-598

98 resultados

Transmissão de dados sensíveis em query string HTTP

A aplicação envia informações sensíveis (senhas, tokens, chaves) como parâmetros de query (URL) em requisições HTTP. Isso expõe os dados em logs de servidor, histórico de browser, proxies intermediários e tráfego de rede — qualquer camada que processa ou registra URLs consegue capturar a informação.

Exemplo

Uma página de login que direciona para 'https://app.com/validar?usuario=joao&senha=abc123' coloca a credencial diretamente visível na URL. Se houver um redirect HTTP→HTTPS ou um proxy corporativo, a senha fica registrada em múltiplos logs; malware no navegador captura pelo histórico.

Como mitigar

Sempre transmita dados sensíveis via POST (não GET/query string) com body encriptado (HTTPS mandatório). Use session tokens ou bearer tokens em headers Authorization em vez de credenciais diretas na URL. Valide e sanitize logs para não registrar parâmetros sensíveis.

CVE-2024-9877MEDIUMSensitive information submitted using GET methodEPSS 0.2%CVE-2026-14838HIGHSession Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2025-14811LOWIBM Sterling Partner Engagement Manager Information DisclosureEPSS 0.2%CVE-2026-10078LOWQuay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystringEPSS 0.2%CVE-2025-51651MEDIUMAn authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbiEPSS 0.2%CVE-2025-32916LOWSensitive form data in URL query parametersEPSS 0.2%CVE-2025-31954MEDIUMHCL iAutomate is susceptible to a sensitive information disclosureEPSS 0.2%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%CVE-2025-1738MEDIUMMultiple vulnerabilities in Trivision Camera NC227WFEPSS 0.2%CVE-2026-27949LOWPlane Exposes User Email (PII and part of credential) in GET ParameterEPSS 0.2%CVE-2026-82181MEDIUMLe-yan｜Medical Practice Management System - Sensitive Data in URLEPSS 0.2%CVE-2026-81632HIGHSingle-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixEPSS 0.2%CVE-2025-69634CRITICALCross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field EPSS 0.1%CVE-2025-54542MEDIUMSending Password in GET RequestEPSS 0.1%CVE-2023-45716LOWHCL Sametime is impacted by a sensitive information disclosureEPSS 0.1%CVE-2025-62317LOWHCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.EPSS 0.1%CVE-2026-47768MEDIUMnebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)EPSS 0.1%CVE-2026-2237MEDIUMA use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1EPSS 0.1%