cve.bz

CWE-552: Files or Directories Accessible to External Parties, page 11

Filter

The product makes files or directories accessible to unauthorized actors, even though they should not be.

What the weakness is: CWE-552 at MITRE

Ask an AI about CWE-552

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-552: Files or Directories Accessible to External Parties and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/552.html and https://cve.bz/cve/cwe/552?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2019-17221EPSS 3.4%

    PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a g…

  2. 3.3CVE-2019-4398EPSS 0.3%

    IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259.

  3. 4.3CVE-2019-17112EPSS 2.1%

    An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user ("Operator" access level) to access the configuration file of the mail server (except for the password).

  4. 5.5CVE-2019-0381EPSS 0.3%

    A binary planting in SAP SQL Anywhere, before version 17.0, SAP IQ, before version 16.1, and SAP Dynamic Tier, before versions 1.0 and 2.0, can result in the inadvertent access of files located in directories outside of the paths specified…

  5. 6.5CVE-2019-17130EPSS 1.0%

    vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.

  6. 5.3CVE-2019-14273EPSS 1.1%

    In SilverStripe assets 4.0, there is broken access control on files.

  7. 6.5CVE-2019-13140EPSS 2.0%

    Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by …

  8. 6.5CVE-2016-10829EPSS 1.0%

    cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).

  9. 8.2CVE-2019-3622EPSS 0.3%

    Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to …

  10. 7.5CVE-2019-10930EPSS 1.8%

    A vulnerability has been identified in All other SIPROTEC 5 device types with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions ), DIGSI 5 engineering software (All versions < V7.90), SIPROTEC 5 d…

  11. 7.8CVE-2019-13404EPSS 1.3%

    The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position i…

  12. 7.5CVE-2019-3569EPSS 1.5%

    HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects…

  13. 6.3CVE-2019-12375EPSS 1.1%

    Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to remote information disclosure and arbitrary code execution.

  14. 7.3CVE-2018-9587EPSS 0.2%

    In savePhotoFromUriToUri of ContactPhotoUtils.java in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is possible unauthorized access to files within the contact app due to a confused deputy scenari…

  15. 6.5CVE-2017-6922EPSS 1.9%

    In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded …

  16. 5.2CVE-2019-3811EPSS 0.7%

    A vulnerability was found in sssd. If a user was configured with no home directory set, sssd would return '/' (the root directory) instead of '' (the empty string / no home directory). This could impact services that restrict the user's fi…

  17. 7.5CVE-2018-16946ExploitEPSS 9.3%

    LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These …

  18. 5.5CVE-2017-2621EPSS 0.4%

    An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensit…

  19. 5.5CVE-2017-2622EPSS 0.4%

    An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information.

  20. 7.5CVE-2018-10869EPSS 2.7%

    redhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file accessible by the user running httpd.

  21. 7.5CVE-2018-5112EPSS 1.9%

    Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances. This could allow the development tools panel for th…

  22. 6.5CVE-2018-1079EPSS 1.1%

    pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /et…

  23. 4.3CVE-2017-1602EPSS 1.2%

    IBM RSA DM (IBM Rational Collaborative Lifecycle Management 5.0 and 6.0) could allow an authenticated user to access settings that they should not be able to using a specially crafted URL. IBM X-Force ID: 132625.

  24. 3.3CVE-2018-0106EPSS 0.3%

    A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restr…

  25. 7.8CVE-2017-15104EPSS 0.4%

    An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

  26. 7.5CVE-2017-12079EPSS 1.8%

    Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field.

  27. 7.8CVE-2017-16651KEVExploitEPSS 46%

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must…

  28. 5.5CVE-2017-7079EPSS 0.9%

    An issue was discovered in certain Apple products. iTunes before 12.7 is affected. The issue involves the "Data Sync" component. It allows attackers to access iOS backups (written by iTunes) via a crafted app.

  29. 5.5CVE-2017-11829EPSS 3.8%

    Microsoft Windows 10 allows an elevation of privilege vulnerability when the Windows Update Delivery Optimization does not properly enforce file share permissions.

  30. 9.8CVE-2017-14942ExploitEPSS 61%

    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.

  31. 7.5CVE-2017-2551EPSS 1.7%

    Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.

  32. 9.8CVE-2017-10930EPSS 1.1%

    The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to steal information like administrator accounts and passwords.

  33. 5.0CVE-2017-6774EPSS 1.2%

    A vulnerability in Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify sensitive system files. The vulnerability is due to the inc…

  34. 4.9CVE-2017-7737EPSS 1.1%

    An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code.

  35. 7.5CVE-2017-11746EPSS 1.1%

    Tenshi 0.15 creates a tenshi.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for tenshi.pid modification before a root script…

  36. 6.5CVE-2017-1308EPSS 1.5%

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0 could allow an authenticated attacker to download files they should not have access to due to improper access controls. IBM X-Force ID: 125462.

  37. 9.6CVE-2015-5211EPSS 2.6%

    Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a …

  38. 5.5CVE-2016-3715KEVExploitEPSS 75%

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

  39. 5.5CVE-2015-1350EPSS 0.5%

    The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability strip…

  40. –CVE-2009-3597ExploitEPSS 3.2%

    Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.

  41. –CVE-2005-1835EPSS 2.0%

    NEXTWEB (i)Site stores databases under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to databases/Users.mdb.