目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-532 通过日志文件的信息暴露 类漏洞列表 662

CWE-532 通过日志文件的信息暴露 类弱点 662 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-532指将敏感信息写入日志文件的漏洞，属于信息泄露类安全风险。攻击者常通过读取服务器日志或访问日志存储位置，窃取密码、密钥或个人隐私数据，进而实施身份冒充或横向移动。开发者应避免在日志中记录明文凭证、会话令牌或敏感业务数据，采用数据脱敏、加密存储及严格的日志访问控制机制，确保仅记录必要的非敏感审计信息，从而降低数据泄露风险。

MITRE CWE 官方描述
CWE：CWE-532 将敏感信息写入日志文件 英文：The product writes sensitive information to a log file.
常见影响 (1)
ConfidentialityRead Application Data
Logging sensitive user data, full path names, or system information often provides attackers with an additional, less-protected path to acquiring the information.
缓解措施 (4)
Architecture and Design, ImplementationConsider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
DistributionRemove debug log files before deploying the application into production.
OperationProtect log files against unauthorized read/write.
ImplementationAdjust configurations appropriately when software is transitioned from a debug state to production.
代码示例 (2)
In the following code snippet, a user's full name and credit card number are written to a log file.
logger.info("Username: " + usernme + ", CCN: " + ccn);
Bad · Java
This code stores location information about the current user:
locationClient = new LocationClient(this, this, this); locationClient.connect(); currentUser.setLocation(locationClient.getLastLocation()); ... catch (Exception e) { AlertDialog.Builder builder = new AlertDialog.Builder(this); builder.setMessage("Sorry, this application has experienced an error."); AlertDialog alert = builder.create(); alert.show(); Log.e("ExampleActivity", "Caught exception: " + e + " While on User:" + User.toString()); }
Bad · Java
CVE ID标题CVSS风险等级Published
CVE-2019-10212 Red Hat Undertow 日志信息泄露漏洞 — undertow 9.8 -2019-10-02
CVE-2019-3763 Dell RSA Identity Governance and Lifecycle和RSA Via Lifecycle and Governance 日志信息泄露漏洞 — RSA Identity Governance and Lifecycle 8.8 High2019-09-11
CVE-2019-11250 Google Kubernetes 日志信息泄露漏洞 — Kubernetes 6.5 -2019-08-29
CVE-2019-5634 Belwith Products Hickory Smart for Android 日志信息泄露漏洞 — Hickory Smart 4.3 -2019-08-22
CVE-2019-13515 OSIsoft PI Web API 日志信息泄露漏洞 — OSIsoft PI Web API 6.5 -2019-08-15
CVE-2019-1961 Cisco Enterprise NFV Infrastructure Software 输入验证错误漏洞 — Cisco Enterprise NFV Infrastructure Software 4.9 -2019-08-08
CVE-2019-1953 Cisco Enterprise NFV Infrastructure Software 日志信息泄露漏洞 — Cisco Enterprise NFV Infrastructure Software 6.5 -2019-08-08
CVE-2019-10165 Red Hat OpenShift Container Platform 日志信息泄露漏洞 — openshift 7.1 -2019-07-30
CVE-2019-11273 Pivotal Software Pivotal Container Service 信息泄露漏洞 — Pivotal Container Service (PKS) 4.3 -2019-07-23
CVE-2019-10194 oVirt Metrics 日志信息泄露漏洞 — ovirt-engine-metrics 5.5 -2019-07-11
CVE-2019-11271 Cloud Foundry BOSH 信息泄露漏洞 — BOSH 7.1 -2019-06-18
CVE-2019-3888 Red Hat Undertow 日志信息泄露漏洞 — undertow 9.8 -2019-06-12
CVE-2019-3891 Red Hat Satellite Candlepin组件日志信息泄露漏洞 — candlepin 7.8 -2019-04-12
CVE-2019-3830 OpenStack Octavia 日志信息泄露漏洞 — openstack-ceilometer 5.5 -2019-03-26
CVE-2018-16856 Red Hat OpenStack Platform 日志信息泄露漏洞 — openstack-octavia 6.2 -2019-03-26
CVE-2018-19014 多款Drager产品安全漏洞 — Dräger Infinity Delta 6.5 -2019-01-28
CVE-2018-16889 debug 日志信息泄露漏洞 — ceph 7.5 -2019-01-28
CVE-2019-0004 Juniper ATP 信息泄露漏洞 — Juniper ATP 5.5 -2019-01-15
CVE-2019-0021 Juniper ATP 安全漏洞 — Juniper ATP 5.5 -2019-01-15
CVE-2018-16859 Ansible Playbooks 信息泄露漏洞 — ansible 6.0 -2018-11-29
CVE-2018-3827 Elasticsearch repository-azure插件信任管理问题漏洞 — Elasticsearch 8.1 -2018-09-19
CVE-2018-3828 Elastic Cloud Enterprise 信息泄露漏洞 — Elastic Cloud Enterprise 8.8 -2018-09-19
CVE-2018-10889 Moodle 信息泄露漏洞 — moodle 5.3 -2018-07-10
CVE-2018-10855 Ansible 安全漏洞 — ansible 5.3 -2018-07-02
CVE-2018-1072 Red Hat oVirt ovirt-engine 信息泄露漏洞 — ovirt-engine-setup 7.1 -2018-06-26
CVE-2018-1117 Red Hat oVirt Ansible Roles 权限许可和访问控制漏洞 — ovirt-ansible-roles 7.5 -2018-06-19
CVE-2018-1075 ovirt-engine 日志信息泄露漏洞 — ovirt-engine 8.4 -2018-06-12
CVE-2018-1241 Dell EMC RecoverPoint和RecoverPoint for Virtual Machines 安全漏洞 — Dell EMC RecoverPoint 8.8 -2018-05-29
CVE-2017-2592 OpenStack oslo.middleware 信息泄露漏洞 — python-oslo-middleware 5.5 -2018-05-08
CVE-2018-3817 Elasticsearch Logstash 信息泄露漏洞 — Logstash 4.3 -2018-03-30

CWE-532（通过日志文件的信息暴露） 是常见的弱点类别，本平台收录该类弱点关联的 662 条 CVE 漏洞。