Logging of Excessive Data
CWE-779
The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9.
How this weakness is prevented
- Architecture and Design: Suppress large numbers of duplicate log messages and replace them with periodic summaries. For example, syslog may include an entry that states last message repeated X times when recording repeated events.
- Architecture and Design: Support a maximum size for the log file that can be controlled by the administrator. If the maximum size is reached, the admin should be notified. Also, consider reducing functionality of the product. This may result in a denial-of-service to legitimate product users, but it will prevent the product from adversely impacting the entire system.
- Implementation: Adjust configurations appropriately when the product is transitioned from a debug state to production.
Latest Logging of Excessive Data vulnerabilities
- 7.5 High severity
Acronis Cyber Protect 17: Logging of Excessive Data
Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
- 7.5 High severity
Stork: Logging of Excessive Data
If an unauthenticated user sends a large amount of data to the Stork UI, it may cause memory and disk use problems for the system running the Stork server. This issue affects Stork versions 1.0.0 through 2.3.0.
- 7.5 High severity
suricata: Asymmetric Resource Consumption (Amplification)
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.8, DNS resource name compression can lead to small DNS messages containing very large hostnames which can be costly to de
- 9.8 Critical severity
cososys_endpoint_protector: Logging of Excessive Data
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to se
- 7.5 High severity
SuiteCRM: Logging of Excessive Data
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a
- 7.5 High severity
cve-services: Cleartext Storage of Sensitive Information
CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not