CVE-2022-1166 JobMonster < 4.6.6.1 - Directory Listing in Upload Folder
An attacker can list files in the upload directory to expose personal data like resumes due to missing directory protection files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1166?
CVE-2022-1166 is a medium-severity vulnerability in Unknown Noo JobMonster, published on 4 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
Weakness: CWE-22
Which versions are affected by CVE-2022-1166?
It affects 1 product.
Products include Nootheme Jobmonster.
How do I fix CVE-2022-1166?
No fix has been published for CVE-2022-1166 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1166 being exploited?
There is no known exploitation of CVE-2022-1166 in the wild and no public exploit code.
Other vulnerabilities in Unknown Noo JobMonster
Sources
Also known as GHSA-952h-ff56-x6g3.