目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-532 通过日志文件的信息暴露 类漏洞列表 770

CWE-532 通过日志文件的信息暴露 类弱点 770 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-532指将敏感信息写入日志文件的漏洞，属于信息泄露类安全风险。攻击者常通过读取服务器日志或访问日志存储位置，窃取密码、密钥或个人隐私数据，进而实施身份冒充或横向移动。开发者应避免在日志中记录明文凭证、会话令牌或敏感业务数据，采用数据脱敏、加密存储及严格的日志访问控制机制，确保仅记录必要的非敏感审计信息，从而降低数据泄露风险。

MITRE CWE 官方描述
CWE：CWE-532 将敏感信息写入日志文件 英文：The product writes sensitive information to a log file.
常见影响 (1)
Confidentiality Read Application Data
Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.
缓解措施 (4)
Architecture and Design, Implementation Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution Remove debug log files before deploying the application into production.
Operation Protect log files against unauthorized read/write.
Implementation Adjust configurations appropriately when software is transitioned from a debug state to production.
代码示例 (2)
In the following code snippet, a user's full name and credit card number are written to a log file.
logger.info("Username: " + usernme + ", CCN: " + ccn);
Bad · Java
This code stores location information about the current user:
locationClient = new LocationClient(this, this, this); locationClient.connect(); currentUser.setLocation(locationClient.getLastLocation()); ... catch (Exception e) { AlertDialog.Builder builder = new AlertDialog.Builder(this); builder.setMessage("Sorry, this application has experienced an error."); AlertDialog alert = builder.create(); alert.show(); Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString()); }
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-20191 Red Hat Ansible 日志信息泄露漏洞 — ansible 5.5 - 2021-05-26
CVE-2021-26908 Automox Alive Automox Agent 日志信息泄露漏洞 — Automox Agent 3.3 Low 2021-04-23
CVE-2021-3036 Palo Alto Networks PAN-OS 日志信息泄露漏洞 — PAN-OS 4.4 Medium 2021-04-20
CVE-2021-3447 红帽 Ansible 日志信息泄露漏洞 — ansible 5.5 - 2021-04-01
CVE-2021-1442 Cisco IOS XE Software 日志信息泄露漏洞 — Cisco IOS XE Software 7.8 - 2021-03-24
CVE-2021-3034 Palo Alto Cortex XSOAR 日志信息泄露漏洞 — Cortex XSOAR 5.1 Medium 2021-03-10
CVE-2021-21361 Gradle 日志信息泄露漏洞 — security-research 5.3 Medium 2021-03-09
CVE-2020-7021 Elasticsearch 日志信息泄露漏洞 — Elasticsearch 4.9 - 2021-02-10
CVE-2021-22133 GE APM 日志信息泄露漏洞 — Elastic APM Agent for Go 2.4 - 2021-02-10
CVE-2021-1226 多款Cisco产品日志信息泄露漏洞 — Cisco Emergency Responder 4.3 Medium 2021-01-13
CVE-2021-3032 Palo Alto Networks PAN-OS 日志信息泄露漏洞 — PAN-OS 4.4 Medium 2021-01-13
CVE-2020-26199 DELL Dell EMC Unity和UnityVSA 日志信息泄露漏洞 — Unity 6.4 Medium 2021-01-05
CVE-2020-8563 Kubernetes 日志日志信息泄露漏洞 — Kubernetes 4.7 Medium 2020-12-07
CVE-2020-8564 Kubernetes 日志日志信息泄露漏洞 — Kubernetes 4.7 Medium 2020-12-07
CVE-2020-8565 Kubernetes 日志日志信息泄露漏洞 — Kubernetes 4.7 Medium 2020-12-07
CVE-2020-8566 Kubernetes 日志日志信息泄露漏洞 — Kubernetes 4.7 Medium 2020-12-07
CVE-2020-10763 Red Hat OpenShift Container Storage 日志信息泄露漏洞 — heketi 5.5 - 2020-11-24
CVE-2020-2048 Palo Alto Networks PAN-OS 日志信息泄露漏洞 — PAN-OS 3.3 Low 2020-11-12
CVE-2020-11646 Secomea GateManager和Secomea SiteManager 安全漏洞 — GateManager 4.3 Medium 2020-10-15
CVE-2020-11643 Secomea GateManager 和 SiteManager 日志信息泄露漏洞 — GateManager 6.5 Medium 2020-10-15
CVE-2020-5389 Dell EMC OpenManage Integration 日志信息泄露漏洞 — OMIMSSC (OpenManage Integration for Microsoft System Center) 6.5 - 2020-10-08
CVE-2020-14330 Red Hat Ansible 安全漏洞 — Ansible 5.0 Medium 2020-09-11
CVE-2020-2043 Palo Alto Networks PAN-OS 日志信息泄露漏洞 — PAN-OS 3.3 Low 2020-09-09
CVE-2020-2044 Palo Alto Networks PAN-OS 日志信息泄露漏洞 — PAN-OS 3.3 Low 2020-09-09
CVE-2020-7322 McAfee Endpoint Security 日志信息泄露漏洞 — Endpoint Security for Windows 4.7 Medium 2020-09-09
CVE-2020-14518 Philips DreamMapper 日志信息泄露漏洞 — DreamMapper 5.3 Medium 2020-08-21
CVE-2020-3447 Cisco Content Security Management Appliance和Email Security Appliance 日志信息泄露漏洞 — Cisco Email Security Appliance (ESA) 5.5 Medium 2020-08-17
CVE-2020-15095 npm CLI 日志信息泄露漏洞 — cli 4.4 Medium 2020-07-07
CVE-2020-10750 jaegertracing/jaeger 日志信息泄露漏洞 — jaegertracing/jaeger 7.1 High 2020-06-19
CVE-2020-12023 Philips IntelliBridge Enterprise 日志信息泄露漏洞 — IntelliBridge Enterprise (IBE) 2.0 Low 2020-06-11

CWE-532（通过日志文件的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 770 条 CVE 漏洞。