目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-552 对外部实体的文件或目录可访问 类漏洞列表 242

CWE-552 对外部实体的文件或目录可访问 类弱点 242 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-552属于权限配置不当类漏洞，指产品错误地将文件或目录暴露给未授权的外部实体。攻击者通常利用此缺陷，通过直接访问服务器根目录下的敏感文件，窃取机密数据或执行恶意操作。开发者应避免在Web或FTP服务器中存放敏感文件，并实施严格的访问控制机制，确保仅授权用户可访问特定资源，从而防止信息泄露。

MITRE CWE 官方描述
CWE：CWE-552 外部可访问的文件或目录 英文：The product makes files or directories accessible to unauthorized actors, even though they should not be. Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories. In cloud technologies and containers, this weakness might present itself in the form of misconfigured storage accounts that can be read or written by a public or anonymous user.
常见影响 (1)
Confidentiality, Integrity Read Files or Directories, Modify Files or Directories
缓解措施 (1)
Implementation, System Configuration, Operation When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
代码示例 (2)
The following Azure command updates the settings for a storage account:
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true
Bad · Shell
az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false
Good · Shell
The following Google Cloud Storage command gets the settings for a storage account named 'BUCKET_NAME':
gsutil iam get gs://BUCKET_NAME
Informative · Shell
{ "bindings":[{ "members":[ "projectEditor: PROJECT-ID", "projectOwner: PROJECT-ID" ], "role":"roles/storage.legacyBucketOwner" }, { "members":[ "allUsers", "projectViewer: PROJECT-ID" ], "role":"roles/storage.legacyBucketReader" } ] }
Bad · JSON
CVE ID 标题 CVSS 风险等级 Published
CVE-2023-2766 Weaver E-Office 安全漏洞 — OA 5.3 Medium 2023-05-17
CVE-2023-29107 Siemens SIMATIC Cloud Connect 安全漏洞 — SIMATIC Cloud Connect 7 CC712 5.3 Medium 2023-05-09
CVE-2023-1246 Saysis Starcities 安全漏洞 — Starcities 7.5 High 2023-03-10
CVE-2022-45052 Axiell Iguana CMS 安全漏洞 — Iguana 8.8 High 2023-01-04
CVE-2022-2981 WordPress plugin Download Monitor 安全漏洞 — Download Monitor 4.9 - 2022-10-10
CVE-2022-39208 Theonedev Onedev 安全漏洞 — onedev 7.5 High 2022-09-13
CVE-2022-1117 glibc 安全特征问题漏洞 — fapolicyd 8.4 - 2022-08-29
CVE-2021-3856 Red Hat Keycloak 路径遍历漏洞 — keycloak 4.3 - 2022-08-26
CVE-2021-4112 Red Hat Ansible 权限许可和访问控制问题漏洞 — ansible-tower 8.8 - 2022-08-25
CVE-2021-3995 util-linux 权限许可和访问控制问题漏洞 — util-linux 5.5 - 2022-08-23
CVE-2021-3996 util-linux 权限许可和访问控制问题漏洞 — util-linux 5.5 - 2022-08-23
CVE-2022-2392 WordPress plugin Lana Downloads Manager 安全漏洞 — Lana Downloads Manager 6.5 - 2022-08-22
CVE-2022-2357 WordPress Plugin WSM Downloader 安全漏洞 — WSM Downloader 7.5 - 2022-08-08
CVE-2022-1585 WordPress plugin Project Source Code Download 安全漏洞 — WordPress project source code download 7.5 - 2022-08-01
CVE-2022-2222 WordPress plugin Download Monitor 安全漏洞 — Download Monitor 4.9 - 2022-07-17
CVE-2022-34464 Siemens SICAM GridEdge Essential 安全漏洞 — SICAM GridEdge (Classic) 6.3 Medium 2022-07-12
CVE-2022-32143 CODESYS 安全漏洞 — Runtime Toolkit 8.8 High 2022-06-24
CVE-2021-3717 Wildfly 安全漏洞 — wildfly 7.8 - 2022-05-24
CVE-2022-0656 WordPress plugin Web To Print Shop : uDraw 安全漏洞 — Web To Print Shop : uDraw 7.5 - 2022-04-25
CVE-2022-24075 Naver Whale Browser 安全漏洞 — NAVER Whale browser 6.5 - 2022-03-17
CVE-2021-32008 Secomea GateManage 路径遍历漏洞 — GateManager 9.9 Critical 2022-03-04
CVE-2021-25004 Wordpress Plugin SEUR Oficial 访问控制错误漏洞 — SEUR Oficial 4.9 - 2022-02-07
CVE-2021-33843 Fresenius Kabi Agilia Connect Infusion System 访问控制错误漏洞 — Agilia Connect WiFi 5.3 Medium 2022-01-21
CVE-2021-43821 Opencast 安全漏洞 — opencast 9.9 Critical 2021-12-14
CVE-2021-31850 Mcafee Database Security Server 安全漏洞 — McAfee Database Security (DBSec) 6.1 Medium 2021-12-08
CVE-2021-42744 Philips Mri 1.5T和Philips Mri 3T 信息泄露漏洞 — MRI 1.5T 5.5 - 2021-11-19
CVE-2021-32833 Emby Server 安全漏洞 — Emby.Releases 8.6 High 2021-09-09
CVE-2021-34765 Cisco Nexus Insights安全漏洞 — Cisco Nexus Insights 4.3 Medium 2021-09-02
CVE-2021-32752 Ether Logs 信息泄露漏洞 — logs 7.2 High 2021-07-09
CVE-2021-22769 Schneider Electric EnerlinÕX ComÕX 安全漏洞 — Easergy T300 with firmware V2.7.1 and older 4.3 - 2021-06-11

CWE-552（对外部实体的文件或目录可访问） 是常见的弱点类别，本平台收录该类弱点关联的 242 条 CVE 漏洞。