Falhas do tipo CWE-548

57 resultados

Exposição de Informações por Listagem de Diretório

Ocorre quando o servidor web lista o conteúdo de um diretório automaticamente, exibindo arquivos e pastas quando não há um arquivo índice (como index.html). Um atacante acessa uma URL de diretório e vê todos os arquivos disponíveis, podendo descobrir backups, arquivos de configuração, código-fonte ou outros ativos sensíveis não intencionados para exposição pública.

Exemplo

Um desenvolvedor carrega assets em /app/resources/ mas esquece de criar um index.html. Ao acessar https://exemplo.com/app/resources/, o servidor Apache com autoindex ativado lista todos os arquivos: backup.sql, config.json com credenciais, e versões antigas do código — tudo visível para qualquer um.

Como mitigar

Desative a listagem automática de diretórios no servidor (DirectoryIndex desativado no Apache, autoindex off, ou equivalente no Nginx). Coloque um index.html ou index.php em cada diretório público, ou restrinja acesso via permissões de arquivo e regras de firewall. Valide regularmente com varreduras que tentam acessar diretórios conhecidos.

CVE-2024-2340MEDIUMAvada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory ListingEPSS 28.0%CVE-2020-8161—A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::DiEPSS 3.4%CVE-2018-14785—NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the device is listed openly EPSS 2.2%CVE-2018-16493—A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the servEPSS 1.8%CVE-2019-5415—A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the vEPSS 1.7%CVE-2018-10590—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 1.7%CVE-2017-6045—An Information Exposure issue was discovered in Trihedral VTScada Versions prior to 11.2.26. Some files are exposed within the web server apEPSS 1.7%CVE-2020-15081MEDIUMInformation exposure in the upload directory in PrestaShopEPSS 1.6%CVE-2019-5437—Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to EPSS 1.3%CVE-2020-7858MEDIUMAquaNPlayer directory traversing vulnerabilityEPSS 1.1%CVE-2025-4807MEDIUMSourceCodester Online Student Clearance System exposure of information through directory listingEPSS 1.1%CVE-2021-27505HIGHmySCADA myPRO Exposure of Information Through Directory ListingEPSS 1.0%CVE-2021-21528HIGHDell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This EPSS 1.0%CVE-2020-15790—A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server mighEPSS 0.9%CVE-2021-32510MEDIUMQSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus functionEPSS 0.9%CVE-2021-32511MEDIUMQSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList functionEPSS 0.9%CVE-2021-23195MEDIUMFresenius Kabi Agilia Connect Infusion System exposure of information through directory listingEPSS 0.8%CVE-2024-8711MEDIUMSourceCodester Food Ordering Management System includes exposure of information through directory listingEPSS 0.8%CVE-2024-7912MEDIUMCodeAstro Online Railway Reservation System assets exposure of information through directory listingEPSS 0.8%CVE-2021-32515MEDIUMQSAN Storage Manager - Exposure of Information Through Directory ListingEPSS 0.8%