CVE-2022-2544 Ninja Job Board < 1.3.3 - Resume Disclosure via Directory Listing
Unauthenticated attackers can download uploaded resumes due to unprotected directory listing in the Ninja Job Board plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2544?
CVE-2022-2544 is a high-severity vulnerability in Unknown Ninja Job Board – Ultimate WordPress Job Board Plugin, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
Weakness: CWE-425
Which versions are affected by CVE-2022-2544?
It affects 1 product.
Products include Wpmanageninja Ninja Job Board.
How do I fix CVE-2022-2544?
No fix has been published for CVE-2022-2544 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2544 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-gx7p-ccw4-fw39.