CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
Description
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-538 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-85g2-pmrx-r49q | CVE-2026-46617 | HIGH |
Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read |
2026-07-21 | |
| GHSA-9c83-rr99-vfwj | CVE-2026-57442 | MODERATE |
MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested |
2026-07-20 | |
| GHSA-5j6p-jrrm-6x94 | CVE-2026-49298 | HIGH |
Apache Airflow: Execution API JWT leaked via KubernetesExecutor worker command-line args |
2026-07-08 | |
| GHSA-8wcj-mfrc-jx5q | CVE-2026-50565 | MODERATE |
Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container |
2026-06-30 | |
| GHSA-524w-vq63-2xhf | CVE-2026-27173 | HIGH |
Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments |
2026-06-05 | |
| GHSA-8452-54wp-rmv6 | CVE-2025-68429 | HIGH |
Storybook manager bundle may expose environment variables during build |
2025-12-18 | |
| GHSA-g2pq-9jr7-w6gv | CVE-2025-58458 | MODERATE |
Jenkins Git client Plugin file system information disclosure vulnerability |
2025-11-05 | |
| GHSA-35gq-cvrm-xf94 | CVE-2025-27017 | MODERATE |
Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record |
2025-07-16 | |
| GHSA-rm97-x556-q36h | CVE-2024-21501 | MODERATE |
sanitize-html Information Exposure vulnerability |
2024-08-28 | |
| GHSA-vx85-mj8c-4qm6 | CVE-2018-11798 | MODERATE |
Apache Thrift Node.js static web server sandbox escape |
2023-09-11 | |
| GHSA-gwvm-vrp4-4pp5 | CVE-2023-28444 | CRITICAL |
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend |
2023-03-24 | |
| GHSA-cm9x-c3rh-7rc4 | CVE-2022-4318 | MODERATE |
CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation |
2022-12-29 | |
| GHSA-xm94-9jw8-p6hw | CVE-2019-10320 | MODERATE |
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin |
2022-06-28 | |
| GHSA-xggc-qprg-x6mw | CVE-2022-31098 | CRITICAL |
Weave GitOps leaked cluster credentials into logs on connection errors |
2022-06-23 | |
| GHSA-7f5c-rpf4-86p8 | CVE-2021-32822 | MODERATE |
Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs |
2021-08-26 |