Weakness (CWE)
CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
More detail
Web servers, FTP servers, and similar servers may store a set of files underneath a "root" directory that is accessible to the server's users. Applications may store sensitive files underneath this root without also using access control to limit which users may request those files, if any. Alternately, an application might package multiple files or directories into an archive file (e.g., ZIP or tar), but the application might not exclude sensitive files that are underneath those directories.
How to prevent it (1 mitigation)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to disable public access.
Source: MITRE CWE-552
427 results · Feed
-
High 7.5
Files or Directories Accessible to External Parties in Saysis Starcities
Files or Directories Accessible to External Parties vulnerability in Saysis Starcities allows Collect Data from Common Resource Locations. This issue affects Starcities: through 1.3.
-
High 7.5
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/downlo…
-
High 7.5
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
-
Medium 5.3
Stored cross-site scripting in BlogEngine.NET version 3.3.8.0
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
-
High 7.5
CRMEB 4.4.4 is vulnerable to Any File download.
-
Medium 4.9
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
-
High 7.5
Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down…
-
Medium 6.5
OpenStack Swift XML external entities (XXE) Injection
An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read…
-
High 8.9
GitOps Run allows for Kubernetes workload injection
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps ru…
-
High 8.8
Local File Inclusion in Axiell Iguana CMS
A Local File Inclusion vulnerability has been found in Axiell Iguana CMS. Due to insufficient neutralisation of user input on the url parameter on the Proxy.type.php endpoint, external users are capable of accessing files on the server.
-
Medium 6.5
Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of …
-
Medium 6.5
The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to includ…
-
High 7.5
The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. Th…
-
High 7.5CVE-2022-44356 Scanner template
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access cont…
-
High 7.5
WordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability
Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
-
Medium 4.9
WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.
-
High 7.5
Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF
Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.…
-
Medium 5.5
Markdownify has Files or Directories Accessible to External Parties
Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least …
-
Medium 5.3
Jenkins NUnit Plugin vulnerable to Protection Mechanism Failure
Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified …
-
High 8.8
There is a file inclusion vulnerability in the template management module in UCMS 1.6
-
Unscored —
Download Monitor < 4.5.98 - Admin+ Arbitrary File Download
The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened enviro…
-
High 7.8CVE-2022-40126 Public exploit
A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate priv…
-
High 7.5CVE-2022-41343 Public exploit
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
-
High 7.5
Git Repository Disclosure in Onedev
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifact…
-
Unscored —
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime li…
-
Medium 4.3
Keycloak has Files or Directories Accessible to External Parties
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of ra…
-
Unscored —
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allow…
-
Medium 4.9
WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability
Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
-
Medium 5.5
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmou…
-
Unscored —
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmou…
-
Unscored —
Lana Downloads Manager < 1.8.0 - Contributor+ Arbitrary File Download
The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.
-
Unscored —
WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download
The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.
-
Unscored —
Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
-
Medium 5.3CVE-2022-33901 Scanner template
WordPress MultiSafepay plugin for WooCommerce plugin <= 4.13.1 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress.
-
Medium 5.5
WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability
Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.
-
Unscored —
Download Monitor < 4.5.91 - Admin+ Arbitrary File Download
The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high privilege users such as admin to download the wp-config.php or /etc/passwd even in an hardened enviro…
-
Medium 6.3
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.7.3). The affected application uses …
-
High 8.8
CODESYS runtime system prone to directory acces
In multiple CODESYS products, file download and upload function allows access to internal files in the working directory e.g. firmware files of the PLC. All requests are processed on the controller only if no level 1 password is configured on the controller o…
-
High 7.5
Arbitrary file read in ginadmin
In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.
-
High 7.8
Wildfly-Core user account mismanagement
A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, an…