Skip to content
OpenAdvisories

Weakness (CWE)

CWE-552: Files or Directories Accessible to External Parties

Base Draft

The product makes files or directories accessible to unauthorized actors, even though they should not be.

More detail

Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration, Operation

    When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.

Source: MITRE CWE-552

All Critical High Medium Low Exploited only Public exploit

47 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-50164 Public exploit EPSS 81%

    Apache Struts: File upload component had a directory traversal vulnerability

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2023-29931

    laravel-s vulnerable to Local File Inclusion

    laravel-s 3.7.35 is vulnerable to Local File Inclusion via /src/Illuminate/Laravel.php.

    hhxsv5/laravel-s Packagist
  • Critical 9.1
    CVE-2023-31066

    Apache InLong: Insecure direct object references for inlong sources

    Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources! Users are …

    Apache Software Foundation Apache InLong org.apache.inlong:manager-service org.apache.inlong:manager-web Maven
  • Critical 9.9
    CVE-2021-32008

    Logged-in Administrator may get unrestricted file system access

    This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories.

    Secomea GateManager
  • Critical 9.9
    CVE-2021-43821 Public exploit

    Files Accessible to External Parties in Opencast

    Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and maki…

    opencast opencast org.opencastproject:opencast-ingest-service-impl Maven
  • Critical 9.8
    CVE-2021-1361

    Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability

    A vulnerability in the implementation of an internal file management service for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode that are running Cisco NX-OS Software could allow an unauthenticated, remote attack…

    Cisco Cisco NX-OS Software Network devices
  • Critical 9.1
    CVE-2020-17519 Exploited Public exploit Scanner template EPSS 98%

    Apache Flink directory traversal attack: reading remote files through the REST API

    A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible b…

    Apache Software Foundation Apache Flink org.apache.flink:flink-runtime_2.11 org.apache.flink:flink-runtime_2.12 Maven
    KEV May 23, 2024