github - ghsa-952h-ff56-x6g3

GHSA-952H-FF56-X6G3

Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-13 00:00

Details

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-1166"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-04T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people\u0027s resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.",
  "id": "GHSA-952h-ff56-x6g3",
  "modified": "2022-04-13T00:00:49Z",
  "published": "2022-04-05T00:00:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1166"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-1166 (GCVE-0-2022-1166)

Vulnerability from cvelistv5 – Published: 2022-04-04 15:36 – Updated: 2024-08-02 23:55

Summary

Severity ?

No CVSS data available.

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

WPScan

References

URL

Tags

	https://wpscan.com/vulnerability/ea6646ac-f71f-43…	x_refsource_MISC
	https://themeforest.net/item/jobmonster-job-board…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Unknown	Noo JobMonster	Affected: 4.5.2.9 , < 4.5.2.9 (custom)

Credits

Daniel Ruf

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:24.352Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Noo JobMonster",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "4.5.2.9",
              "status": "affected",
              "version": "4.5.2.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Daniel Ruf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people\u0027s resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-04T15:36:05",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "JobMonster \u003c 4.6.6.1 - Directory Listing in Upload Folder",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2022-1166",
          "STATE": "PUBLIC",
          "TITLE": "JobMonster \u003c 4.6.6.1 - Directory Listing in Upload Folder"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Noo JobMonster",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "4.5.2.9",
                            "version_value": "4.5.2.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Daniel Ruf"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people\u0027s resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189"
            },
            {
              "name": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446",
              "refsource": "MISC",
              "url": "https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-1166",
    "datePublished": "2022-04-04T15:36:05",
    "dateReserved": "2022-03-30T00:00:00",
    "dateUpdated": "2024-08-02T23:55:24.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-952H-FF56-X6G3

CVE-2022-1166 (GCVE-0-2022-1166)

Tags

Sightings

Nomenclature