CWE-538
AllowedInsertion of Sensitive Information into Externally-Accessible File or Directory
Abstraction: Base · Status: Draft
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
172 vulnerabilities reference this CWE, most recent first.
GHSA-PX84-JF5M-HCJV
Vulnerability from github – Published: 2026-10-14 12:31 – Updated: 2026-10-14 12:31A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
{
"affected": [],
"aliases": [
"CVE-2026-109970"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T10:17:52Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.",
"id": "GHSA-px84-jf5m-hcjv",
"modified": "2026-10-14T12:31:32Z",
"published": "2026-10-14T12:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109970"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-109970"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550362"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PXFX-PC9F-JPPF
Vulnerability from github – Published: 2026-08-05 18:31 – Updated: 2026-08-05 18:31IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.
{
"affected": [],
"aliases": [
"CVE-2026-12762"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T16:16:49Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.",
"id": "GHSA-pxfx-pc9f-jppf",
"modified": "2026-08-05T18:31:35Z",
"published": "2026-08-05T18:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12762"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7282605"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QC88-R3JC-R9HR
Vulnerability from github – Published: 2026-09-09 09:33 – Updated: 2026-09-09 09:33Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
{
"affected": [],
"aliases": [
"CVE-2026-80175"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T09:17:12Z",
"severity": "LOW"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.",
"id": "GHSA-qc88-r3jc-r9hr",
"modified": "2026-09-09T09:33:00Z",
"published": "2026-09-09T09:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80175"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJP7-GVRW-VXMF
Vulnerability from github – Published: 2024-12-10 03:31 – Updated: 2024-12-10 03:31An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.
{
"affected": [],
"aliases": [
"CVE-2024-47580"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-10T01:15:05Z",
"severity": "MODERATE"
},
"details": "An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.",
"id": "GHSA-qjp7-gvrw-vxmf",
"modified": "2024-12-10T03:31:45Z",
"published": "2024-12-10T03:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47580"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3536965"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QPV6-4QP6-6JQX
Vulnerability from github – Published: 2025-11-21 00:30 – Updated: 2025-11-21 18:30Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.
{
"affected": [],
"aliases": [
"CVE-2025-61138"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-20T22:16:01Z",
"severity": "HIGH"
},
"details": "Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.",
"id": "GHSA-qpv6-4qp6-6jqx",
"modified": "2025-11-21T18:30:28Z",
"published": "2025-11-21T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61138"
},
{
"type": "WEB",
"url": "https://gist.github.com/Israel0x00/8a81ec98162e9ca8e4a3a6c8b4ef4762"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QR2Q-986W-CCV6
Vulnerability from github – Published: 2022-05-17 04:47 – Updated: 2025-09-19 21:31The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.
{
"affected": [],
"aliases": [
"CVE-2014-0771"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-12T04:37:00Z",
"severity": "MODERATE"
},
"details": "The OpenUrlToBuffer method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a file: URL.",
"id": "GHSA-qr2q-986w-ccv6",
"modified": "2025-09-19T21:31:14Z",
"published": "2022-05-17T04:47:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0771"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03"
},
{
"type": "WEB",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-079-03"
},
{
"type": "WEB",
"url": "http://webaccess.advantech.com"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/66740"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R46V-FWC3-FP9X
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2024-04-04 01:44A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.
{
"affected": [],
"aliases": [
"CVE-2019-12623"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-21T18:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.",
"id": "GHSA-r46v-fwc3-fp9x",
"modified": "2024-04-04T01:44:36Z",
"published": "2022-05-24T16:54:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12623"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RH59-VGH2-8M84
Vulnerability from github – Published: 2025-01-07 18:30 – Updated: 2026-04-01 18:33Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.7.7.
{
"affected": [],
"aliases": [
"CVE-2025-22306"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T17:15:32Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.7.7.",
"id": "GHSA-rh59-vgh2-8m84",
"modified": "2026-04-01T18:33:05Z",
"published": "2025-01-07T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22306"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/link-whisper/vulnerability/wordpress-link-whisper-free-plugin-0-7-7-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RM97-X556-Q36H
Vulnerability from github – Published: 2024-02-24 06:30 – Updated: 2024-08-28 21:58Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sanitize-html"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.12.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21501"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-538"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-01T16:55:53Z",
"nvd_published_at": "2024-02-24T05:15:44Z",
"severity": "MODERATE"
},
"details": "Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.",
"id": "GHSA-rm97-x556-q36h",
"modified": "2024-08-28T21:58:16Z",
"published": "2024-02-24T06:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21501"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/sanitize-html/pull/650"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4"
},
{
"type": "WEB",
"url": "https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf"
},
{
"type": "WEB",
"url": "https://github.com/apostrophecms/apostrophe/discussions/4436"
},
{
"type": "PACKAGE",
"url": "https://github.com/apostrophecms/sanitize-html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "sanitize-html Information Exposure vulnerability"
}
GHSA-VJQC-8HQX-GPV2
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2024-04-04 01:28cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
{
"affected": [],
"aliases": [
"CVE-2018-20932"
],
"database_specific": {
"cwe_ids": [
"CWE-538"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-01T16:15:00Z",
"severity": "MODERATE"
},
"details": "cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).",
"id": "GHSA-vjqc-8hqx-gpv2",
"modified": "2024-04-04T01:28:37Z",
"published": "2022-05-24T16:52:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20932"
},
{
"type": "WEB",
"url": "https://documentation.cpanel.net/display/CL/70+Change+Log"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Do not expose file and directory information to the user.
CAPEC-95: WSDL Scanning
This attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities. This type of probing is carried out to perform more serious attacks (e.g. parameter tampering, malicious content injection, command injection, etc.). WSDL files provide detailed information about the services ports and bindings available to consumers. For instance, the attacker can submit special characters or malicious content to the Web service and can cause a denial of service condition or illegal access to database records. In addition, the attacker may try to guess other private methods by using the information provided in the WSDL files.