目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

CWE-779 日志记录过多数据 类漏洞列表 12

CWE-779 日志记录过多数据 类弱点 12 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-779属于日志记录不当漏洞，指系统在运行过程中过度记录详细数据。攻击者常利用此缺陷，通过海量日志淹没关键安全警报，阻碍管理员发现异常行为或延缓事后取证分析。开发者应避免在生产环境记录敏感或冗余信息，实施日志分级策略，仅保留必要审计数据，从而确保日志文件的可读性与安全性，提升威胁检测效率。

MITRE CWE 官方描述
CWE：CWE-779 记录过多数据 (Logging of Excessive Data) 英文：产品记录了过多的信息，导致日志文件难以处理，并可能在攻击后阻碍恢复工作或取证分析。 虽然日志记录总体上是一种良好的实践，并且在开发阶段的调试过程中使用非常高级别的日志记录是合适的，但在生产环境中记录过多的数据可能会阻碍系统管理员检测异常状况的能力。这可能会为攻击者在尝试渗透系统时提供掩护，使取证分析的审计线索变得杂乱，或者使在生产环境中调试问题变得更加困难。
常见影响 (3)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Other)
Log files can become so large that they consume excessive resources, such as disk and CPU, which can hinder the performance of the system.
Non-RepudiationHide Activities
Logging too much information can make the log files of less use to forensics analysts and developers when trying to diagnose a problem or recover from an attack.
Non-RepudiationHide Activities
If system administrators are unable to effectively process log files, attempted attacks may go undetected, possibly leading to eventual system compromise.
缓解措施 (3)
Architecture and DesignSuppress large numbers of duplicate log messages and replace them with periodic summaries. For example, syslog may include an entry that states "last message repeated X times" when recording repeated events.
Architecture and DesignSupport a maximum size for the log file that can be controlled by the administrator. If the maximum size is reached, the admin should be notified. Also, consider reducing functionality of the product. This may result in a denial-of-service to legitimate product users, but it will prevent the product from adversely impacting the entire system.
ImplementationAdjust configurations appropriately when the product is transitioned from a debug state to production.
CVE ID标题CVSS风险等级Published
CVE-2026-28718 Acronis Cyber Protect 安全漏洞 — Acronis Cyber Protect 17 7.5 -2026-03-05
CVE-2025-69230 aiohttp 安全漏洞 — aiohttp--2026-01-05
CVE-2024-36416 SuiteCRM 安全漏洞 — SuiteCRM 8.6 High2024-06-10
CVE-2024-1141 python-glance-store 安全漏洞 5.5 Medium2024-02-01
CVE-2022-39874 SAMSUNG Mobile devices 日志信息泄露漏洞 — Samsung Account 4.0 Medium2022-10-07
CVE-2022-31004 cve-services 安全漏洞 — cve-services 7.5 High2022-05-25
CVE-2022-25779 Secomea GateManager 资源管理错误漏洞 — GateManager 4.3 Medium2022-05-04
CVE-2022-22291 Samsung telephony 安全漏洞 — Samsung Mobile Devices 5.5 Medium2022-02-11
CVE-2021-25420 Samsung Galaxy Watch PlugIn 日志信息泄露漏洞 — Galaxy Watch PlugIn 5.5 -2021-06-11
CVE-2021-25421 Samsung Mobile Galaxy Watch PlugIn 日志信息泄露漏洞 — Galaxy Watch3 PlugIn 5.5 -2021-06-11
CVE-2021-25422 Samsung Watch Active2 PlugIn 日志信息泄露漏洞 — Watch Active PlugIn 5.5 -2021-06-11
CVE-2021-25423 Samsung Watch Active2 PlugIn 日志信息泄露漏洞 — Watch Active2 PlugIn 5.5 -2021-06-11

CWE-779（日志记录过多数据） 是常见的弱点类别，本平台收录该类弱点关联的 12 条 CVE 漏洞。