CWE-538
AllowedInsertion of Sensitive Information into Externally-Accessible File or Directory
Abstraction: Base · Status: Draft
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
172 vulnerabilities reference this CWE, most recent first.
GHSA-GWVM-VRP4-4PP5
Vulnerability from github – Published: 2023-03-24 22:04 – Updated: 2023-03-24 22:04Impact
angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory. During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).
With version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.
This has NO IMPACT, in a plain Angular project that has no backend component.
Patches
Vulnerability has been mitigated in 15.1.0, by adding an option searchPattern which restricts the detection file range by default.
# Update via npm
npm update angular-server-side-configuration
## Or more specific
npm install angular-server-side-configuration@15.1.0
# Update via pnpm
pnpm update angular-server-side-configuration
## Or more specific
pnpm add angular-server-side-configuration@15.1.0
# Update via yarn
yarn update angular-server-side-configuration
## Or more specific
yarn add angular-server-side-configuration@15.1.0
Workarounds
Manually edit or create ngssc.json or run a script after ngssc.json generation
References
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "angular-server-side-configuration"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0"
},
{
"fixed": "15.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-28444"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-538"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-24T22:04:35Z",
"nvd_published_at": "2023-03-24T20:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nangular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory.\nDuring deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).\n\nWith version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.\n\nThis has NO IMPACT, in a plain Angular project that has no backend component.\n\n### Patches\nVulnerability has been mitigated in 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default.\n\n```bash\n# Update via npm\nnpm update angular-server-side-configuration\n## Or more specific\nnpm install angular-server-side-configuration@15.1.0\n\n# Update via pnpm\npnpm update angular-server-side-configuration\n## Or more specific\npnpm add angular-server-side-configuration@15.1.0\n\n# Update via yarn\nyarn update angular-server-side-configuration\n## Or more specific\nyarn add angular-server-side-configuration@15.1.0\n```\n\n### Workarounds\nManually edit or create ngssc.json or run a script after ngssc.json generation\n\n### References\n\n ",
"id": "GHSA-gwvm-vrp4-4pp5",
"modified": "2023-03-24T22:04:35Z",
"published": "2023-03-24T22:04:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28444"
},
{
"type": "WEB",
"url": "https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86"
},
{
"type": "PACKAGE",
"url": "https://github.com/kyubisation/angular-server-side-configuration"
},
{
"type": "WEB",
"url": "https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend"
}
GHSA-H26C-C6VW-JJJM
Vulnerability from github – Published: 2025-03-18 18:30 – Updated: 2025-03-19 21:30yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.
{
"affected": [],
"aliases": [
"CVE-2025-25586"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T16:15:27Z",
"severity": "MODERATE"
},
"details": "yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.",
"id": "GHSA-h26c-c6vw-jjjm",
"modified": "2025-03-19T21:30:52Z",
"published": "2025-03-18T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25586"
},
{
"type": "WEB",
"url": "https://gitee.com/r1bbit/yimioa/issues/IBI7LR"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H68H-QCXP-QV6V
Vulnerability from github – Published: 2026-03-12 18:30 – Updated: 2026-03-12 18:30A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
{
"affected": [],
"aliases": [
"CVE-2026-21672"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-12T17:16:35Z",
"severity": "HIGH"
},
"details": "A vulnerability allowing local privilege escalation on Windows-based Veeam Backup \u0026 Replication servers.",
"id": "GHSA-h68h-qcxp-qv6v",
"modified": "2026-03-12T18:30:31Z",
"published": "2026-03-12T18:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21672"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4830"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4831"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JWFG-733H-8PC5
Vulnerability from github – Published: 2024-05-15 18:30 – Updated: 2024-11-18 16:26On Windows systems, the Arc configuration files resulted to be world-readable.
This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.
{
"affected": [],
"aliases": [
"CVE-2023-5937"
],
"database_specific": {
"cwe_ids": [
"CWE-538",
"CWE-732"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-15T16:15:09Z",
"severity": "MODERATE"
},
"details": "On Windows systems, the Arc configuration files resulted to be world-readable.\n\n\n\nThis can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.",
"id": "GHSA-jwfg-733h-8pc5",
"modified": "2024-11-18T16:26:42Z",
"published": "2024-05-15T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5937"
},
{
"type": "WEB",
"url": "https://security.nozominetworks.com/NN-2023:15-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M28R-JG2J-26CV
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2026-06-02 21:30A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.
{
"affected": [],
"aliases": [
"CVE-2017-9947"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-23T08:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions \u003cV3.5. A directory traversal vulnerability could allow a remote attacker with network access to the integrated web server (80/tcp and 443/tcp) to obtain information on the structure of the file system of the affected devices.",
"id": "GHSA-m28r-jg2j-26cv",
"modified": "2026-06-02T21:30:27Z",
"published": "2022-05-13T01:36:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9947"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-148078.pdf"
},
{
"type": "WEB",
"url": "https://packetstorm.news/files/id/169544"
},
{
"type": "WEB",
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-148078.pdf"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/169544/Siemens-APOGEE-PXC-TALON-TC-Authentication-Bypass.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101248"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M532-3CC3-2P5V
Vulnerability from github – Published: 2025-02-24 00:30 – Updated: 2026-04-01 18:33Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Matt Cromwell Give – Divi Donation Modules allows Retrieve Embedded Sensitive Data. This issue affects Give – Divi Donation Modules: from n/a through 2.0.0.
{
"affected": [],
"aliases": [
"CVE-2025-22633"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-23T23:15:10Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Matt Cromwell Give \u2013 Divi Donation Modules allows Retrieve Embedded Sensitive Data. This issue affects Give \u2013 Divi Donation Modules: from n/a through 2.0.0.",
"id": "GHSA-m532-3cc3-2p5v",
"modified": "2026-04-01T18:33:45Z",
"published": "2025-02-24T00:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22633"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/give-donation-modules-for-divi/vulnerability/wordpress-give-divi-donation-modules-plugin-2-0-0-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M6F8-6M3M-X2RV
Vulnerability from github – Published: 2026-05-21 09:32 – Updated: 2026-07-27 15:32Honeywell Control Network Module (CNM) contains insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing system files, potentially resulting in unintended access to protected data.
{
"affected": [],
"aliases": [
"CVE-2026-5434"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-21T09:16:30Z",
"severity": "MODERATE"
},
"details": "Honeywell Control\nNetwork Module (CNM)\u00a0contains\ninsertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability through probing\nsystem files, potentially resulting in unintended\naccess to protected data.",
"id": "GHSA-m6f8-6m3m-x2rv",
"modified": "2026-07-27T15:32:12Z",
"published": "2026-05-21T09:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5434"
},
{
"type": "WEB",
"url": "https://process.honeywell.com"
},
{
"type": "WEB",
"url": "https://www.honeywell.com/us/en/product-security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MHJP-XC38-M6XR
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible.
{
"affected": [],
"aliases": [
"CVE-2018-10590"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-15T22:29:00Z",
"severity": "HIGH"
},
"details": "In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible.",
"id": "GHSA-mhjp-xc38-m6xr",
"modified": "2022-05-13T01:35:01Z",
"published": "2022-05-13T01:35:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10590"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104190"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MWJC-697V-R7M7
Vulnerability from github – Published: 2023-09-14 12:30 – Updated: 2024-04-04 07:40A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.
{
"affected": [],
"aliases": [
"CVE-2023-38558"
],
"database_specific": {
"cwe_ids": [
"CWE-538",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-14T11:15:07Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (All versions). The affected application leaks Windows admin credentials. An attacker with local access to the Administration Console could get the credentials, and impersonate the admin user, thereby gaining admin access to other Windows systems.",
"id": "GHSA-mwjc-697v-r7m7",
"modified": "2024-04-04T07:40:13Z",
"published": "2023-09-14T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38558"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-646240.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PCH2-3675-W238
Vulnerability from github – Published: 2026-06-02 15:32 – Updated: 2026-06-02 15:32Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated network attackers to access log files over a network connection. Attackers can retrieve device internals, location information, and wired network configuration details from the exposed log files.
{
"affected": [],
"aliases": [
"CVE-2019-25717"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-02T14:16:24Z",
"severity": "MODERATE"
},
"details": "Dr\u00e4ger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated network attackers to access log files over a network connection. Attackers can retrieve device internals, location information, and wired network configuration details from the exposed log files.",
"id": "GHSA-pch2-3675-w238",
"modified": "2026-06-02T15:32:09Z",
"published": "2026-06-02T15:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25717"
},
{
"type": "WEB",
"url": "https://static.draeger.com/security"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/dr-ger-infinity-delta-kappa-patient-monitors-unauthenticated-log-file-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Do not expose file and directory information to the user.
CAPEC-95: WSDL Scanning
This attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities. This type of probing is carried out to perform more serious attacks (e.g. parameter tampering, malicious content injection, command injection, etc.). WSDL files provide detailed information about the services ports and bindings available to consumers. For instance, the attacker can submit special characters or malicious content to the Web service and can cause a denial of service condition or illegal access to database records. In addition, the attacker may try to guess other private methods by using the information provided in the WSDL files.